From 08f9e5632da83aae9866f0805e8879fa7039c7b0 Mon Sep 17 00:00:00 2001 From: Bryce Kwon Date: Sat, 31 Oct 2026 14:38:24 -0700 Subject: Refuse pathspec magic through one helper --- source/ui-patch.c | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-) (limited to 'source/ui-patch.c') diff --git a/source/ui-patch.c b/source/ui-patch.c index d4a8c5a..0d29e38 100644 --- a/source/ui-patch.c +++ b/source/ui-patch.c @@ -28,12 +28,8 @@ void cgit_print_patch(const char *new_rev, const char *old_rev, const char *pref if (!new_rev) new_rev = ctx.qry.head; - // A leading colon makes git read the path as a pathspec with magic, - // which can end the request inside git after the headers are out. - if (prefix && prefix[0] == ':') { - cgit_print_error_page(400, "Bad Request", "Invalid path"); + if (cgit_refuse_pathspec_magic(prefix)) return; - } commit = cgit_get_commit(new_rev, &new_oid); if (!commit || cgit_get_old_oid(old_rev, commit, &old_oid)) -- cgit