From 08f9e5632da83aae9866f0805e8879fa7039c7b0 Mon Sep 17 00:00:00 2001
From: Bryce Kwon <bryce@brycekwon.com>
Date: Sat, 31 Oct 2026 14:38:24 -0700
Subject: Refuse pathspec magic through one helper

---
 source/ui-stats.c | 6 +-----
 1 file changed, 1 insertion(+), 5 deletions(-)

(limited to 'source/ui-stats.c')

diff --git a/source/ui-stats.c b/source/ui-stats.c
index 83a4ee9..a0ad442 100644
--- a/source/ui-stats.c
+++ b/source/ui-stats.c
@@ -409,12 +409,8 @@ void cgit_show_stats(void)
 		cgit_print_error_page(400, "Bad Request", "Statistics type disabled: %s", period->name);
 		return;
 	}
-	// A leading colon makes git read the path as a pathspec with magic,
-	// which can end the request inside git.
-	if (ctx.qry.path && ctx.qry.path[0] == ':') {
-		cgit_print_error_page(400, "Bad Request", "Invalid path");
+	if (cgit_refuse_pathspec_magic(ctx.qry.path))
 		return;
-	}
 	if (collect_stats(period, &authors))
 		return;
 	QSORT(authors.items, authors.nr, cmp_total_commits);
-- 
cgit