From 42adaa11aa0a66645d4cf94488c88660cea00c41 Mon Sep 17 00:00:00 2001 From: Bryce Kwon Date: Mon, 21 Sep 2026 21:34:12 -1000 Subject: Harden the page renderers --- source/ui-clone.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) (limited to 'source/ui-clone.c') diff --git a/source/ui-clone.c b/source/ui-clone.c index 4329e9d..2544e9f 100644 --- a/source/ui-clone.c +++ b/source/ui-clone.c @@ -72,6 +72,7 @@ static void print_pack_info(void) // directly leaves those packs unfindable. for (entry = packfile_store_get_packs(files->packed); entry; entry = entry->next) { struct packed_git *pack = entry->pack; + if (pack->pack_local) htmlf("P %s\n", last_path_component(pack->pack_name)); } @@ -79,8 +80,7 @@ static void print_pack_info(void) } /* - * Beyond the obvious directory traversal, the strict character set heads off - * other funny business, for example the file name quirks of the Cygwin port. + * Only the characters an object path can hold pass, and no dotdot component. */ static int path_is_safe(const char *path) { @@ -112,6 +112,11 @@ static void send_file(const char *path) } return; } + // fopen opens a directory on most systems and reads nothing from it. + if (!S_ISREG(st.st_mode)) { + cgit_print_error_page(404, "Not Found", "Not found"); + return; + } ctx.page.mimetype = "application/octet-stream"; // Offer the file under its path inside the repository, so the layout // of the server's disk stays out of the download name. -- cgit v2.8.0