From 8e18915afce30469d2878cccdf81d5cefa951a23 Mon Sep 17 00:00:00 2001 From: Bryce Kwon Date: Sat, 17 Oct 2026 12:53:17 -1000 Subject: Refuse pathspec magic in the feed as in the log A feed path starting with a colon reached git as pathspec magic, so an unknown magic word ended the request in a 500 and a known one changed what the path matched, while the log answers both with a 400. --- source/ui-atom.c | 8 ++++++++ 1 file changed, 8 insertions(+) (limited to 'source/ui-atom.c') diff --git a/source/ui-atom.c b/source/ui-atom.c index 39cadb8..0f82c0d 100644 --- a/source/ui-atom.c +++ b/source/ui-atom.c @@ -164,6 +164,14 @@ void cgit_print_atom(char *tip, const char *path, int max_count) int argc = 2; bool need_updated = true; + // A leading colon makes git read the path as a pathspec with magic, + // which can end the request inside git, so the feed refuses it as the + // log does. + if (path && path[0] == ':') { + cgit_print_error_page(400, "Bad Request", "Invalid path"); + return; + } + if (ctx.qry.show_all) argv[1] = "--all"; else if (!tip) -- cgit