don't use user input for repository path access
1 file changed, 7 insertions(+), 21 deletions(-)
changed files
M routes/git.go → routes/git.go
@@ -6,7 +6,6 @@ "compress/gzip" "io" "log" "net/http" - "path" "alin.ovh/elgit/git/service" "github.com/savsgio/atreugo/v11"@@ -14,16 +13,9 @@ "github.com/valyala/fasthttp" ) func (d *deps) InfoRefs(rc *atreugo.RequestCtx) error { - category, _ := rc.UserValue("category").(string) - name, _ := rc.UserValue("name").(string) - repoName := path.Join(category, name) - - repo, err := d.GetCleanPath(repoName) - if err != nil { - log.Printf("getcleanpath error: %v", err) + repoName, _ := rc.UserValue("repoName").(string) - return d.NotFound(rc) - } + repo := d.repos.BySlug[repoName] svc := rc.QueryArgs().Peek("service") if string(svc) == "git-receive-pack" {@@ -35,7 +27,7 @@ rc.Response.Header.Set("content-type", "application/x-git-upload-pack-advertisement") rc.Response.Header.Set("cache-control", "no-cache") cmd := service.Command{ - Dir: repo, + Dir: repo.Path, Stdout: rc, }@@ -43,16 +35,9 @@ return cmd.InfoRefs(rc) } func (d *deps) UploadPack(rc *atreugo.RequestCtx) error { - category, _ := rc.UserValue("category").(string) - name, _ := rc.UserValue("name").(string) - repoName := path.Join(category, name) + repoName, _ := rc.UserValue("repoName").(string) - repo, err := d.GetCleanPath(repoName) - if err != nil { - log.Printf("getcleanpath error: %v", err) - - return d.NotFound(rc) - } + repo := d.repos.BySlug[repoName] rc.SetStatusCode(http.StatusOK) rc.SetContentType("application/x-git-upload-pack-result")@@ -74,6 +59,7 @@ reader = bytes.NewReader(rc.Request.Body()) } if bytes.Contains(rc.Request.Header.ContentEncoding(), []byte("gzip")) { + var err error reader, err = gzip.NewReader(reader) if err != nil { return rc.ErrorResponse(err, 500)@@ -81,7 +67,7 @@ } } cmd := service.Command{ - Dir: repo, + Dir: repo.Path, Stdout: rc, Stdin: reader, }