From 3c8913bbc676603072b03d568438e5bbafbc83b4 Mon Sep 17 00:00:00 2001 From: Bryce Kwon Date: Fri, 16 Oct 2026 06:09:53 -1000 Subject: Gate a readme ending in a colon like a disk path trust-scan-config passed any readme holding a colon as a tracked file, while the parser takes one only when a path follows the colon, so a scanned repository could still name a file on disk outside itself. The two now share one test. --- source/shared.h | 6 ++++++ 1 file changed, 6 insertions(+) (limited to 'source/shared.h') diff --git a/source/shared.h b/source/shared.h index ca2ac6a..13932c8 100644 --- a/source/shared.h +++ b/source/shared.h @@ -109,6 +109,12 @@ extern char *cgit_expand_macros(const char *text); extern char *cgit_get_mimetype_for_filename(const char *filename); +/* + * Whether a readme setting names a file tracked in the repository, written + * as ref:path or :path, rather than a file on the server's disk. + */ +extern int cgit_readme_is_tracked(const char *readme); + /* * Whether a revision from the request is a hex object id or a possible ref * name, the only forms cgit hands to git. -- cgit