From 3c8913bbc676603072b03d568438e5bbafbc83b4 Mon Sep 17 00:00:00 2001 From: Bryce Kwon Date: Fri, 16 Oct 2026 06:09:53 -1000 Subject: Gate a readme ending in a colon like a disk path trust-scan-config passed any readme holding a colon as a tracked file, while the parser takes one only when a path follows the colon, so a scanned repository could still name a file on disk outside itself. The two now share one test. --- source/scan-tree.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) (limited to 'source/scan-tree.c') diff --git a/source/scan-tree.c b/source/scan-tree.c index 035e4e1..b941ec5 100644 --- a/source/scan-tree.c +++ b/source/scan-tree.c @@ -52,8 +52,8 @@ static int is_git_dir(const char *path) * A repository's own files belong to whoever can push to it, so the keys * that run a command, put raw markup on the page, hand a file to the browser * as markup, read a file off the disk or place a link wait on - * trust-scan-config. A readme naming a git object, the form with a colon, - * only reads from the repository and passes. + * trust-scan-config. A readme naming a tracked file only reads from the + * repository and passes. */ static int trusted_key(const char *name, const char *value) { @@ -70,7 +70,7 @@ static int trusted_key(const char *name, const char *value) !strcmp(name, "logo-link") || !strcmp(name, "clone-url") || !strcmp(name, "enable-html-serving") || - (!strcmp(name, "readme") && !strchr(value, ':')); + (!strcmp(name, "readme") && !cgit_readme_is_tracked(value)); if (!untrusted) return 1; fprintf(stderr, "[cgit] Ignoring %s in %s: trust-scan-config is not set\n", name, -- cgit