From 81c332fc885bbcb2624edde4dc0226e9fd8f706f Mon Sep 17 00:00:00 2001 From: Bryce Kwon Date: Sat, 17 Oct 2026 17:09:13 -1000 Subject: Serve only the files a dumb clone asks for The object path check let any run of safe characters through, so a spelling such as info//alternates or info/./alternates reached the alternates file the exact name was refused for. Only a loose object, a pack with its index and info/http-alternates are served now, and any other path is not found. --- tests/t0301-security.sh | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'tests/t0301-security.sh') diff --git a/tests/t0301-security.sh b/tests/t0301-security.sh index 3df2cee..d9ec265 100755 --- a/tests/t0301-security.sh +++ b/tests/t0301-security.sh @@ -452,10 +452,10 @@ test_expect_success 'a posted length past any buffer is clamped' ' test_expect_success 'the dumb transport refuses a path that climbs out' ' cveq "url=cve/objects/../config" >tmp && - grep "^Status: 400" tmp && + grep "^Status: 404" tmp && ! grep "repositoryformatversion" tmp && cveq "url=cve/objects/info/../../config" >tmp && - grep "^Status: 400" tmp && + grep "^Status: 404" tmp && ! grep "repositoryformatversion" tmp ' -- cgit