web frontend for git (tangled's grandpa)
7
fork

Configure Feed

Select the types of activity you want to include in your feed.

all: use securejoin for path joining

+73 -11
+13 -2
routes/git.go
··· 8 8 "path/filepath" 9 9 10 10 "git.icyphox.sh/legit/git/service" 11 + securejoin "github.com/cyphar/filepath-securejoin" 11 12 ) 12 13 13 14 func (d *deps) InfoRefs(w http.ResponseWriter, r *http.Request) { 14 15 name := r.PathValue("name") 15 16 name = filepath.Clean(name) 16 17 17 - repo := filepath.Join(d.c.Repo.ScanPath, name) 18 + repo, err := securejoin.SecureJoin(d.c.Repo.ScanPath, name) 19 + if err != nil { 20 + log.Printf("securejoin error: %v", err) 21 + d.Write404(w) 22 + return 23 + } 18 24 19 25 w.Header().Set("content-type", "application/x-git-upload-pack-advertisement") 20 26 w.WriteHeader(http.StatusOK) ··· 35 41 name := r.PathValue("name") 36 42 name = filepath.Clean(name) 37 43 38 - repo := filepath.Join(d.c.Repo.ScanPath, name) 44 + repo, err := securejoin.SecureJoin(d.c.Repo.ScanPath, name) 45 + if err != nil { 46 + log.Printf("securejoin error: %v", err) 47 + d.Write404(w) 48 + return 49 + } 39 50 40 51 w.Header().Set("content-type", "application/x-git-upload-pack-result") 41 52 w.Header().Set("Connection", "Keep-Alive")
+60 -9
routes/routes.go
··· 15 15 16 16 "git.icyphox.sh/legit/config" 17 17 "git.icyphox.sh/legit/git" 18 + securejoin "github.com/cyphar/filepath-securejoin" 18 19 "github.com/dustin/go-humanize" 19 20 "github.com/microcosm-cc/bluemonday" 20 21 "github.com/russross/blackfriday/v2" ··· 45 46 continue 46 47 } 47 48 48 - path := filepath.Join(d.c.Repo.ScanPath, name) 49 + path, err := securejoin.SecureJoin(d.c.Repo.ScanPath, name) 50 + if err != nil { 51 + log.Printf("securejoin error: %v", err) 52 + d.Write404(w) 53 + return 54 + } 55 + 49 56 gr, err := git.Open(path, "") 50 57 if err != nil { 51 58 log.Println(err) ··· 92 99 return 93 100 } 94 101 name = filepath.Clean(name) 95 - path := filepath.Join(d.c.Repo.ScanPath, name) 102 + path, err := securejoin.SecureJoin(d.c.Repo.ScanPath, name) 103 + if err != nil { 104 + log.Printf("securejoin error: %v", err) 105 + d.Write404(w) 106 + return 107 + } 96 108 97 109 gr, err := git.Open(path, "") 98 110 if err != nil { ··· 177 189 ref := r.PathValue("ref") 178 190 179 191 name = filepath.Clean(name) 180 - path := filepath.Join(d.c.Repo.ScanPath, name) 192 + path, err := securejoin.SecureJoin(d.c.Repo.ScanPath, name) 193 + if err != nil { 194 + log.Printf("securejoin error: %v", err) 195 + d.Write404(w) 196 + return 197 + } 181 198 gr, err := git.Open(path, ref) 182 199 if err != nil { 183 200 d.Write404(w) ··· 218 235 ref := r.PathValue("ref") 219 236 220 237 name = filepath.Clean(name) 221 - path := filepath.Join(d.c.Repo.ScanPath, name) 238 + path, err := securejoin.SecureJoin(d.c.Repo.ScanPath, name) 239 + if err != nil { 240 + log.Printf("securejoin error: %v", err) 241 + d.Write404(w) 242 + return 243 + } 244 + 222 245 gr, err := git.Open(path, ref) 223 246 if err != nil { 224 247 d.Write404(w) ··· 271 294 setContentDisposition(w, filename) 272 295 setGZipMIME(w) 273 296 274 - path := filepath.Join(d.c.Repo.ScanPath, name) 297 + path, err := securejoin.SecureJoin(d.c.Repo.ScanPath, name) 298 + if err != nil { 299 + log.Printf("securejoin error: %v", err) 300 + d.Write404(w) 301 + return 302 + } 303 + 275 304 gr, err := git.Open(path, ref) 276 305 if err != nil { 277 306 d.Write404(w) ··· 307 336 } 308 337 ref := r.PathValue("ref") 309 338 310 - path := filepath.Join(d.c.Repo.ScanPath, name) 339 + path, err := securejoin.SecureJoin(d.c.Repo.ScanPath, name) 340 + if err != nil { 341 + log.Printf("securejoin error: %v", err) 342 + d.Write404(w) 343 + return 344 + } 345 + 311 346 gr, err := git.Open(path, ref) 312 347 if err != nil { 313 348 d.Write404(w) ··· 347 382 } 348 383 ref := r.PathValue("ref") 349 384 350 - path := filepath.Join(d.c.Repo.ScanPath, name) 385 + path, err := securejoin.SecureJoin(d.c.Repo.ScanPath, name) 386 + if err != nil { 387 + log.Printf("securejoin error: %v", err) 388 + d.Write404(w) 389 + return 390 + } 351 391 gr, err := git.Open(path, ref) 352 392 if err != nil { 353 393 d.Write404(w) ··· 388 428 return 389 429 } 390 430 391 - path := filepath.Join(d.c.Repo.ScanPath, name) 431 + path, err := securejoin.SecureJoin(d.c.Repo.ScanPath, name) 432 + if err != nil { 433 + log.Printf("securejoin error: %v", err) 434 + d.Write404(w) 435 + return 436 + } 437 + 392 438 gr, err := git.Open(path, "") 393 439 if err != nil { 394 440 d.Write404(w) ··· 428 474 429 475 func (d *deps) ServeStatic(w http.ResponseWriter, r *http.Request) { 430 476 f := r.PathValue("file") 431 - f = filepath.Clean(filepath.Join(d.c.Dirs.Static, f)) 477 + f = filepath.Clean(f) 478 + f, err := securejoin.SecureJoin(d.c.Dirs.Static, f) 479 + if err != nil { 480 + d.Write404(w) 481 + return 482 + } 432 483 433 484 http.ServeFile(w, r, f) 434 485 }