Diff options
| -rw-r--r-- | source/ui-stats.c | 6 | |
| -rwxr-xr-x | tests/t0112-stats.sh | 9 |
2 files changed, 15 insertions, 0 deletions
diff --git a/source/ui-stats.c b/source/ui-stats.c index 6cb2653..555b795 100644 --- a/source/ui-stats.c +++ b/source/ui-stats.c @@ -452,6 +452,12 @@ void cgit_show_stats(void) cgit_print_error_page(400, "Bad Request", "Statistics type disabled: %s", period->name); return; } + // A leading colon makes git read the path as a pathspec with magic, + // which can end the request inside git. + if (ctx.qry.path && ctx.qry.path[0] == ':') { + cgit_print_error_page(400, "Bad Request", "Invalid path"); + return; + } if (collect_stats(period, &authors)) return; cgit_qsort(authors.items, authors.nr, sizeof(struct string_list_item), cmp_total_commits); diff --git a/tests/t0112-stats.sh b/tests/t0112-stats.sh index 7e1fcc5..3728412 100755 --- a/tests/t0112-stats.sh +++ b/tests/t0112-stats.sh @@ -124,4 +124,13 @@ test_expect_success 'the window opens at midnight on its first day' ' ! grep ">Too Early<" tmp ' +# A path starting with a colon would reach git as pathspec magic, which the +# log, the feed and the patch page refuse as well. +test_expect_success 'a path with pathspec magic is refused' ' + statq "url=stat/stats/%3A%28icase%29FILE-1" >tmp && + grep "^Status: 400" tmp && + statq "url=stat/stats/file-1" >tmp && + grep "^Status: 200" tmp +' + test_done |