From 42adaa11aa0a66645d4cf94488c88660cea00c41 Mon Sep 17 00:00:00 2001
From: Bryce Kwon <bryce@brycekwon.com>
Date: Mon, 21 Sep 2026 21:34:12 -1000
Subject: Harden the page renderers

---
 source/ui-log.c | 97 +++++++++++++++++++++++++++++++++++++++++----------------
 1 file changed, 71 insertions(+), 26 deletions(-)

(limited to 'source/ui-log.c')

diff --git a/source/ui-log.c b/source/ui-log.c
index 316df75..86cb756 100644
--- a/source/ui-log.c
+++ b/source/ui-log.c
@@ -176,6 +176,9 @@ static void wrap_subject(struct commitinfo *info, struct strbuf *msg)
 		--cut;
 	if (!cut)
 		cut = ctx.cfg.max_msg_len - strlen(wrap_symbol);
+	// A cut inside a multibyte character would leave both halves invalid.
+	while (cut > 0 && (info->subject[cut] & 0xC0) == 0x80)
+		--cut;
 
 	strbuf_add(msg, info->subject + cut, subject_len - cut);
 	strbuf_trim(msg);
@@ -244,7 +247,7 @@ static void print_commit(struct commit *commit, struct rev_info *revs)
 		oid_to_hex(&commit->object.oid), ctx.qry.vpath);
 	cgit_print_commit_decorations(commit);
 	html("</td><td class='col-author'>");
-	cgit_open_filter(ctx.repo->email_filter, info->author_email, "log");
+	cgit_open_filter(ctx.repo->email_filter, info->author_email ? info->author_email : "", "log");
 	html_txt(info->author);
 	cgit_close_filter(ctx.repo->email_filter);
 
@@ -286,8 +289,9 @@ static void print_commit(struct commit *commit, struct rev_info *revs)
 			int msg_lines = ctx.qry.showmsg ? line_count(msgbuf.buf) : 0;
 
 			print_graph_padding(revs, &graphbuf, msg_lines);
-		} else
+		} else {
 			html("<td></td>");
+		}
 
 		// Either way one cell is already on the row, so the message
 		// spans the remaining columns.
@@ -317,6 +321,27 @@ static const char *disambiguate_ref(const char *ref, int *must_free_result)
 	return ref;
 }
 
+/*
+ * A range token is one revision, or two joined by two or three dots, and each
+ * side has to pass cgit_valid_rev. An empty side means HEAD to git.
+ */
+static int valid_range_token(const char *arg)
+{
+	const char *dots = strstr(arg, "..");
+	char *left;
+	int ok;
+
+	if (!dots)
+		return cgit_valid_rev(arg);
+	left = xstrndup(arg, dots - arg);
+	dots += 2;
+	if (*dots == '.')
+		dots++;
+	ok = (!*left || cgit_valid_rev(left)) && (!*dots || cgit_valid_rev(dots));
+	free(left);
+	return ok;
+}
+
 static char *next_token(char **src)
 {
 	char *token;
@@ -348,7 +373,7 @@ static void print_pager(struct rev_info *revs, int ofs, int cnt)
 	struct commit *more = get_revision(revs);
 
 	html("</table>\n");
-	// A single page needs no pager, and an empty list is just noise.
+	// A single page needs no pager, and an empty list has nothing to page.
 	if (ofs <= 0 && !more)
 		return;
 	html("<ul class='pager'>");
@@ -378,7 +403,7 @@ static void print_pager(struct rev_info *revs, int ofs, int cnt)
 void cgit_print_commit_decorations(struct commit *commit)
 {
 	const struct name_decoration *deco;
-	static char buf[1024];
+	const char *buf;
 
 	deco = get_name_decoration(&commit->object);
 	if (!deco)
@@ -388,12 +413,13 @@ void cgit_print_commit_decorations(struct commit *commit)
 		struct object_id oid_tag, peeled;
 		int is_annotated = 0;
 
-		strlcpy(buf, prettify_refname(deco->name), sizeof(buf));
+		buf = prettify_refname(deco->name);
 		switch (deco->type) {
 		case DECORATION_NONE:
 			break;
 		case DECORATION_REF_LOCAL:
-			cgit_log_link(buf, NULL, "branch-deco", buf, NULL, ctx.qry.vpath, 0, NULL, NULL, ctx.qry.showmsg, 0);
+			cgit_log_link(buf, NULL, "branch-deco", buf, NULL, ctx.qry.vpath, 0, NULL, NULL,
+				ctx.qry.showmsg, 0);
 			break;
 		case DECORATION_REF_TAG:
 			if (!refs_read_ref(get_main_ref_store(the_repository), deco->name, &oid_tag) &&
@@ -411,7 +437,8 @@ void cgit_print_commit_decorations(struct commit *commit)
 			);
 			break;
 		default:
-			cgit_commit_link(buf, NULL, "deco", ctx.qry.head, oid_to_hex(&commit->object.oid), ctx.qry.vpath);
+			cgit_commit_link(buf, NULL, "deco", ctx.qry.head, oid_to_hex(&commit->object.oid),
+				ctx.qry.vpath);
 			break;
 		}
 		deco = deco->next;
@@ -435,11 +462,10 @@ void cgit_print_log(const char *tip, int ofs, int cnt, char *grep, char *pattern
 	if (!tip)
 		tip = ctx.qry.head;
 	tip = disambiguate_ref(tip, &must_free_tip);
-	if (tip && tip[0] == '-') {
-		// setup_revisions() reads a leading-dash argument as an
-		// option, so a tip like "--output=<path>" would become a
-		// request to write an arbitrary file. No valid ref or object
-		// name begins with a dash, so refuse it.
+	// Checked here as well as in prepare_repo_cmd, since a caller can pass
+	// a tip of its own and setup_revisions reads a leading dash as an
+	// option.
+	if (tip && !cgit_valid_rev(tip)) {
 		cgit_print_error_page(400, "Bad Request", "Invalid revision");
 		if (must_free_tip)
 			free((char *)tip);
@@ -448,6 +474,16 @@ void cgit_print_log(const char *tip, int ofs, int cnt, char *grep, char *pattern
 	}
 	strvec_push(&rev_argv, tip);
 
+	// A leading colon makes git read the path as a pathspec with magic,
+	// which can end the request inside git.
+	if (path && path[0] == ':') {
+		cgit_print_error_page(400, "Bad Request", "Invalid path");
+		if (must_free_tip)
+			free((char *)tip);
+		strvec_clear(&rev_argv);
+		return;
+	}
+
 	if (grep && pattern && *pattern) {
 		pattern = xstrdup(pattern);
 		if (!strcmp(grep, "grep") || !strcmp(grep, "author") || !strcmp(grep, "committer")) {
@@ -455,16 +491,17 @@ void cgit_print_log(const char *tip, int ofs, int cnt, char *grep, char *pattern
 		} else if (!strcmp(grep, "range")) {
 			char *arg;
 
-			// Each whitespace separated token is taken as a
-			// revision expression only, since a leading dash
-			// would reach setup_revisions as a rev-list option.
-			// The tip pushed above goes away, since the range
-			// supersedes it.
+			// Each whitespace separated token has to pass the same
+			// check as any other revision. The tip pushed above goes
+			// away, since the range supersedes it.
 			strvec_pop(&rev_argv);
 			while ((arg = next_token(&pattern))) {
-				if (*arg == '-') {
-					fprintf(stderr, "[cgit] Bad range expression: %s\n", arg);
-					break;
+				if (!valid_range_token(arg)) {
+					cgit_print_error_page(400, "Bad Request", "Invalid revision");
+					if (must_free_tip)
+						free((char *)tip);
+					strvec_clear(&rev_argv);
+					return;
 				}
 				strvec_push(&rev_argv, arg);
 			}
@@ -504,6 +541,10 @@ void cgit_print_log(const char *tip, int ofs, int cnt, char *grep, char *pattern
 	load_ref_decorations(NULL, DECORATE_FULL_REFS);
 	rev.show_decorations = 1;
 	rev.grep_filter.ignore_case = 1;
+	// The search is literal. A pattern would run as a regular expression
+	// over every message in the history, and one with a backreference
+	// takes exponential time to match.
+	rev.grep_filter.pattern_type_option = GREP_PATTERN_TYPE_FIXED;
 
 	rev.diffopt.detect_rename = 1;
 	rev.diffopt.rename_limit = ctx.cfg.renamelimit;
@@ -511,7 +552,13 @@ void cgit_print_log(const char *tip, int ofs, int cnt, char *grep, char *pattern
 		DIFF_XDL_SET(&rev.diffopt, IGNORE_WHITESPACE);
 
 	compile_grep_patterns(&rev.grep_filter);
-	prepare_revision_walk(&rev);
+	// A failed setup leaves the walk holding freed commits, so it must
+	// not be read from.
+	if (prepare_revision_walk(&rev)) {
+		cgit_print_error_page(500, "Internal Server Error", "Unable to read the history");
+		strvec_clear(&rev_argv);
+		return;
+	}
 
 	if (pager) {
 		cgit_print_layout_start();
@@ -549,14 +596,14 @@ void cgit_print_log(const char *tip, int ofs, int cnt, char *grep, char *pattern
 	if (ofs < 0)
 		ofs = 0;
 
-	for (i = 0; i < ofs && (commit = get_revision(&rev)) != NULL; ) {
+	for (i = 0; i < ofs && (commit = get_revision(&rev)); ) {
 		if (should_show(commit, &rev))
 			i++;
 		release_commit_memory(the_repository->parsed_objects, commit);
 		commit->parents = NULL;
 	}
 
-	for (i = 0; i < cnt && (commit = get_revision(&rev)) != NULL; ) {
+	for (i = 0; i < cnt && (commit = get_revision(&rev)); ) {
 		// Clearing the flag per commit keeps a commit from being
 		// diffed twice when the file or line columns are on.
 		counts_ready = 0;
@@ -570,7 +617,7 @@ void cgit_print_log(const char *tip, int ofs, int cnt, char *grep, char *pattern
 	if (pager) {
 		print_pager(&rev, ofs, cnt);
 		cgit_print_layout_end();
-	} else if ((commit = get_revision(&rev)) != NULL) {
+	} else if ((commit = get_revision(&rev))) {
 		htmlf("<tr class='nohover'><td colspan='%d'>", columns);
 		cgit_log_link(
 			"[...]", NULL, NULL, ctx.qry.head, NULL, ctx.qry.vpath, 0,
@@ -579,8 +626,6 @@ void cgit_print_log(const char *tip, int ofs, int cnt, char *grep, char *pattern
 		html("</td></tr>\n");
 	}
 
-	// The cast is safe because must_free_tip is only set for a string this
-	// function allocated.
 	if (must_free_tip)
 		free((char *)tip);
 }
-- 
cgit v2.8.0