don't use user input for repository path access
1 file changed, 0 insertions(+), 9 deletions(-)
changed files
M routes/util.go → routes/util.go
@@ -5,14 +5,12 @@ "bufio" "fmt" "log" "os" - "path" "path/filepath" "slices" "strings" "alin.ovh/elgit/data" "alin.ovh/elgit/git" - securejoin "github.com/cyphar/filepath-securejoin" "github.com/microcosm-cc/bluemonday" "github.com/russross/blackfriday/v2" "github.com/savsgio/atreugo/v11"@@ -46,13 +44,6 @@ } func (d *deps) isNotAllowed(name string) bool { return d.repos.BySlug[name] == nil -} - -func (d *deps) GetCleanPath(name string) (string, error) { - return securejoin.SecureJoin( - filepath.Join(d.c.Repo.Root, "repositories"), - path.Clean(name)+".git", - ) } func ReadProjectsList(filename string) ([]string, error) {