From e6f4c2ad43095eb184ee0665eedea99ed9bed729 Mon Sep 17 00:00:00 2001 From: Bryce Kwon Date: Sat, 31 Oct 2026 13:14:19 -0700 Subject: Refuse pathspec magic on the stats page --- source/ui-stats.c | 6 ++++++ tests/t0112-stats.sh | 9 +++++++++ 2 files changed, 15 insertions(+) diff --git a/source/ui-stats.c b/source/ui-stats.c index 6cb2653..555b795 100644 --- a/source/ui-stats.c +++ b/source/ui-stats.c @@ -452,6 +452,12 @@ void cgit_show_stats(void) cgit_print_error_page(400, "Bad Request", "Statistics type disabled: %s", period->name); return; } + // A leading colon makes git read the path as a pathspec with magic, + // which can end the request inside git. + if (ctx.qry.path && ctx.qry.path[0] == ':') { + cgit_print_error_page(400, "Bad Request", "Invalid path"); + return; + } if (collect_stats(period, &authors)) return; cgit_qsort(authors.items, authors.nr, sizeof(struct string_list_item), cmp_total_commits); diff --git a/tests/t0112-stats.sh b/tests/t0112-stats.sh index 7e1fcc5..3728412 100755 --- a/tests/t0112-stats.sh +++ b/tests/t0112-stats.sh @@ -124,4 +124,13 @@ test_expect_success 'the window opens at midnight on its first day' ' ! grep ">Too Early<" tmp ' +# A path starting with a colon would reach git as pathspec magic, which the +# log, the feed and the patch page refuse as well. +test_expect_success 'a path with pathspec magic is refused' ' + statq "url=stat/stats/%3A%28icase%29FILE-1" >tmp && + grep "^Status: 400" tmp && + statq "url=stat/stats/file-1" >tmp && + grep "^Status: 200" tmp +' + test_done -- cgit