about summary refs log tree commit diff
diff options
context:
space:
mode:
authorJason A. Donenfeld <Jason@zx2c4.com>2018-08-03 15:46:11 +0200
committerJason A. Donenfeld <Jason@zx2c4.com>2018-08-03 17:04:03 +0200
commit53efaf30b50f095cad8c160488c74bba3e3b2680 (patch)
tree48c0be88bfef03400ddd4b3871baf9de9dbe0b77
parentconfig: record repo.snapshot-prefix in the per-repo config (diff)
downloadcgit-pink-53efaf30b50f095cad8c160488c74bba3e3b2680.tar.gz
cgit-pink-53efaf30b50f095cad8c160488c74bba3e3b2680.zip
clone: fix directory traversal
This was introduced in the initial version of this code, way back when
in 2008.

$ curl http://127.0.0.1/cgit/repo/objects/?path=../../../../../../../../../etc/passwd
root:x:0:0:root:/root:/bin/sh
...

Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
Reported-by: Jann Horn <jannh@google.com>
-rw-r--r--ui-clone.c23
1 files changed, 19 insertions, 4 deletions
diff --git a/ui-clone.c b/ui-clone.c
index 2c1ac3d..6ba8f36 100644
--- a/ui-clone.c
+++ b/ui-clone.c
@@ -92,17 +92,32 @@ void cgit_clone_info(void)
 
 void cgit_clone_objects(void)
 {
-	if (!ctx.qry.path) {
-		cgit_print_error_page(400, "Bad request", "Bad request");
-		return;
-	}
+	char *p;
+
+	if (!ctx.qry.path)
+		goto err;
 
 	if (!strcmp(ctx.qry.path, "info/packs")) {
 		print_pack_info();
 		return;
 	}
 
+	/* Avoid directory traversal by forbidding "..", but also work around
+	 * other funny business by just specifying a fairly strict format. For
+	 * example, now we don't have to stress out about the Cygwin port.
+	 */
+	for (p = ctx.qry.path; *p; ++p) {
+		if (*p == '.' && *(p + 1) == '.')
+			goto err;
+		if (!isalnum(*p) && *p != '/' && *p != '.' && *p != '-')
+			goto err;
+	}
+
 	send_file(git_path("objects/%s", ctx.qry.path));
+	return;
+
+err:
+	cgit_print_error_page(400, "Bad request", "Bad request");
 }
 
 void cgit_clone_head(void)
>2019-02-27Fix make target pattern whitespace in hiJune McEnroe 2019-02-27Delete extraneous <pre> in html.shJune McEnroe 2019-02-24Use setopt in upJune McEnroe 2019-02-24Add setoptJune McEnroe 2019-02-20Match make targets as TagJune McEnroe 2019-02-20Use $PWD in html.sh to pass absolute path to manJune McEnroe 2019-02-20Factor out html.sh and produce html for all sourcesJune McEnroe Except for gfx-cocoa because I don't have an Objective-C highlighter. Also hypothetically the .h rule could match up headers with .3 manual pages if I cared to write them. 2019-02-20Add Dirk Gently's Holistic Detective AgencyJune McEnroe 2019-02-20Move /opt/pkg after /usr in PATHJune McEnroe Installing mandoc from pkgsrc also installs a man executable which is horribly broken. Keep using the system man. 2019-02-20Set man_hard_wrap in nvimJune McEnroe Vendoring man.vim until <https://github.com/neovim/neovim/pull/9633> is merged and appears in a release. 2019-02-18Use hi -o anchor in upJune McEnroe 2019-02-18Don't match nested parentheses in Tag for CJune McEnroe Fixes mistaken highlight of: pngWrite(file, (uint8_t []) { 0, 0, 0 }, 3); 2019-02-18Match whitespace between * [] {}June McEnroe 2019-02-18Fix function-like #define regexJune McEnroe A define like #define FOO (1) is not function-like. 2019-02-18Match Tag in RustJune McEnroe 2019-02-18Match sh functions as TagJune McEnroe 2019-02-18Match Sh and Ss as Tag in mdocJune McEnroe 2019-02-18Match statics and typedefs as TagJune McEnroe 2019-02-18Clean up htmlHeaderJune McEnroe 2019-02-18Remove hi line numberingJune McEnroe Tags are much better for referring to specific parts of a file and line numbering is better done by a post-processing tool such as cat -n or producing a two-column HTML <table>. 2019-02-18Add Tag class to hiJune McEnroe 2019-02-17Generate HTML with hi -n -f html -o anchorJune McEnroe Running hi twice to insert stuff between the head and the content is a bit of a hack but oh well. 2019-02-17Add hi -f html -o anchor for line number linksJune McEnroe 2019-02-17Simplify temp trap in upJune McEnroe 2019-02-17Add line numbers to hiJune McEnroe Renames previous -n option to -m to stay consistent with cat -n. Prefixing lines with line numbers affects where the first tab indent ends up relative to the text above it. Not sure if it's worth fixing somehow. 2019-02-17Always split spans after newlinesJune McEnroe Simplifies ANSI and IRC output code, and prepares for line numbered output. 2019-02-15Color format specifiers light cyan in vimJune McEnroe 2019-02-15Highlight Interp as yellowJune McEnroe 2019-02-15Highlight strings in sh command substitutionsJune McEnroe 2019-02-15Add nmap gpJune McEnroe 2019-02-14Avoid newline when copying URL to pasteboardJune McEnroe 2019-02-13Add forgotten "sixth" book of H2G2June McEnroe