syntax-highlighting.sh: Fix command injection. - cgit-pink - DON'T USE THIS! --- web frontend for git

diff options

author	Jason A. Donenfeld <Jason@zx2c4.com>	2012-10-27 20:03:41 -0600
committer	Jason A. Donenfeld <Jason@zx2c4.com>	2012-10-27 20:05:50 -0600
commit	7ea35f9f8ecf61ab42be9947aae1176ab6e089bd (patch)
tree	e6639ab10546026d9ff73dd6e9381a5808218ed9 /README
parent	Fix man page typo. (diff)
download	cgit-pink-7ea35f9f8ecf61ab42be9947aae1176ab6e089bd.tar.gz cgit-pink-7ea35f9f8ecf61ab42be9947aae1176ab6e089bd.zip

syntax-highlighting.sh: Fix command injection.

By not quoting the argument, an attacker with the ability to add files
to the repository could pass arbitrary arguments to the highlight
command, in particular, the --plug-in argument which can lead to
arbitrary command execution.

This patch adds simple argument quoting.

Diffstat (limited to 'README')

0 files changed, 0 insertions, 0 deletions

shes stdout for us, but when we redirect stdout to the cache it points to a regular file so Git no longer flushes the output for us. The patch is still correct, but perhaps the full explanation is interesting! Reported-by: Konstantin Ryabitsev <mricon@kernel.org> 2014-06-28ui-log: ignore unhandled argumentsJohn Keeping If you search for a bogus range string here: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/log/ Using something like "range" and "qwerty123456", it returns an "Internal Server Error" and the following in the logs: > [Tue Jun 10 17:45:32 2014] [error] [client 172.21.1.6] fatal: > ambiguous argument 'qwerty123456': unknown revision or path not in the > working tree., referer: > http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/ > [Tue Jun 10 17:45:32 2014] [error] [client 172.21.1.6] Use '--' to > separate paths from revisions, like this:, referer: > http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/ > [Tue Jun 10 17:45:32 2014] [error] [client 172.21.1.6] 'git <command> > [<revision>...] -- [<file>...]', referer: > http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/ > [Tue Jun 10 17:45:32 2014] [error] [client 172.21.1.6] Premature end > of script headers: cgit, referer: > http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/ The cache will kick in, so if you search for the same string again, it'll show an empty range, so you have to change the bogus strings each time. This is because we just pass the arguments straight to Git's revision parsing machinery which die()s if it cannot parse an argument, printing the above to stderr and exiting. The patch below makes it a bit friendlier by just ignoring unhandled arguments, but I can't see an easy way to report errors when we can't parse revision arguments without losing the flexibility of supporting all of the revision specifiers supported by Git. Reported-by: Konstantin Ryabitsev <mricon@kernel.org> 2014-06-28git: update for git 2.0Christian Hesse prefixcmp() and suffixcmp() have been remove, functionality is now provided by starts_with() and ends_with(). Retrurn values have been changed, so instead of just renaming we have to fix logic. Everything else looks just fine. 2014-04-17remove trailing whitespaces from source filesChristian Hesse 2014-04-12git: update to 1.9.2Christian Hesse Everything works just bumping the version in Makefile and commit hash in submodule. No code changes required. 2014-04-05Fix cgit_parse_url when a repo url is contained in another repo urlJulian Maurice For example, if I have two repos (remove-suffix is enabled): /foo /foo/bar http://cgit/foo/bar/ is interpreted as "repository 'foo', command 'bar'" instead of "repository 'foo/bar'" 2014-03-20Makefile: use more reliable git tarball mirrorJason A. Donenfeld 2014-03-20git: update to 1.9.1Christian Hesse


context:
space:
mode: