1
0
Fork 0
mirror of https://github.com/git/git.git synced 2024-03-28 20:19:59 +01:00

Merge branch 'rs/daemon-sanitize-dir-sep'

"git daemon" has been tightened against systems that take backslash
as directory separator.

* rs/daemon-sanitize-dir-sep:
  daemon: sanitize all directory separators
This commit is contained in:
Junio C Hamano 2021-04-08 13:23:26 -07:00
commit bde35a2a93

View File

@ -566,14 +566,14 @@ static void parse_host_and_port(char *hostport, char **host,
/*
* Sanitize a string from the client so that it's OK to be inserted into a
* filesystem path. Specifically, we disallow slashes, runs of "..", and
* trailing and leading dots, which means that the client cannot escape
* our base path via ".." traversal.
* filesystem path. Specifically, we disallow directory separators, runs
* of "..", and trailing and leading dots, which means that the client
* cannot escape our base path via ".." traversal.
*/
static void sanitize_client(struct strbuf *out, const char *in)
{
for (; *in; in++) {
if (*in == '/')
if (is_dir_sep(*in))
continue;
if (*in == '.' && (!out->len || out->buf[out->len - 1] == '.'))
continue;