{"thread":{"id":"31492","subject":"Confirm my false error suspicions of Gitweb query injection","startedAt":"2012-09-10T16:45:08Z","lastAt":"2012-09-10T17:41:35Z","messageCount":4,"participants":["Joseph Leong","Matthieu Moy","Junio C Hamano"],"isPatch":false,"patchVersion":null,"patchTotal":null},"messages":[{"id":"198693","messageId":"CAMOg_eUjmnisevN+AaArz+6TMpWYJL660xwG0ptEaTO7stcL6A@mail.gmail.com","threadId":"31492","inReplyTo":null,"subject":"Confirm my false error suspicions of Gitweb query injection","fromName":"Joseph Leong","fromEmail":"josephcleong@gmail.com","sentAt":"2012-09-10T16:45:08Z","receivedAt":"2012-09-10T16:45:08Z","isPatch":false,"sender":{"key":"josephcleong@gmail.com","avatar":null},"body":"Hi Everyone,\n\nI'm using Gitweb (Based on Git 1.7.9 on RHEL 5.8).\n\nI was poking around and tried a GET Request (REQ) with some SQL\nstatements as a search query and noticed a 500. Can i just confirm\nwith anyone here that the error message I'm seeing in the Response\n(RESP) is basically saying that the search parameters are invalid\nbecause of it's funny chars are breaking the regex search and that\nit's not anything database related.  Thank you!\n\n[REQ]\nGET /git/?s=%28select+1234%2C HTTP/1.0\n\n[RESP]\n500 - Internal Server Error\nUnmatched ( in regex; marked by &lt;-- HERE in m/( &lt;-- HERE select\n1234,/ at /var/www/git/gitweb.cgi line 4845.\n\n[Code at gitweb.cgi line 4845]\nnext if $searchtext and not $pr->{'path'} =~ /$searchtext/ and not\n$pr->{'descr_long'} =~ /$searchtext/;\n"},{"id":"198698","messageId":"vpqvcflhk9c.fsf@bauges.imag.fr","threadId":"31492","inReplyTo":"CAMOg_eUjmnisevN+AaArz+6TMpWYJL660xwG0ptEaTO7stcL6A@mail.gmail.com","subject":"Re: Confirm my false error suspicions of Gitweb query injection","fromName":"Matthieu Moy","fromEmail":"matthieu.moy@grenoble-inp.fr","sentAt":"2012-09-10T17:15:27Z","receivedAt":"2012-09-10T17:15:27Z","isPatch":false,"sender":{"key":"matthieu.moy@grenoble-inp.fr","avatar":"https://gravatar.com/avatar/72c8a2705971a25dfaff23cece15130d405685845d911aedd5667ace277f3fc5?d=mp&s=160"},"body":"Joseph Leong <josephcleong@gmail.com> writes:\n\n> [RESP]\n> 500 - Internal Server Error\n> Unmatched ( in regex; marked by &lt;-- HERE in m/( &lt;-- HERE select\n> 1234,/ at /var/www/git/gitweb.cgi line 4845.\n\nGitweb is feeding your input as a perl regex, which is not really clean\nbut shouldn't really harm either.\n\nI could reproduce with an old gitweb version, but newer gitwebs seem to\nbe more clever about regular expression (there's an explicit tickbox to\nsearch for re, and the error message is clean when what you provide\nisn't a valid regexp).\n\n-- \nMatthieu Moy\nhttp://www-verimag.imag.fr/~moy/\n"},{"id":"198701","messageId":"7vlighok2h.fsf@alter.siamese.dyndns.org","threadId":"31492","inReplyTo":"CAMOg_eUjmnisevN+AaArz+6TMpWYJL660xwG0ptEaTO7stcL6A@mail.gmail.com","subject":"Re: Confirm my false error suspicions of Gitweb query injection","fromName":"Junio C Hamano","fromEmail":"gitster@pobox.com","sentAt":"2012-09-10T17:37:42Z","receivedAt":"2012-09-10T17:37:42Z","isPatch":false,"sender":{"key":"gitster@pobox.com","avatar":"https://avatars.githubusercontent.com/u/54884?v=4"},"body":"Joseph Leong <josephcleong@gmail.com> writes:\n\n> Hi Everyone,\n>\n> I'm using Gitweb (Based on Git 1.7.9 on RHEL 5.8).\n>\n> I was poking around and tried a GET Request (REQ) with some SQL\n> statements as a search query and noticed a 500. Can i just confirm\n> with anyone here that the error message I'm seeing in the Response\n> (RESP) is basically saying that the search parameters are invalid\n> because of it's funny chars are breaking the regex search and that\n> it's not anything database related.\n\nYes, I think this was fixed in v1.7.9.4 if not earlier, with e65ceb6\n(gitweb: Fix fixed string (non-regexp) project search, 2012-03-02).\n"},{"id":"198702","messageId":"CAMOg_eUVm08jQSNR1F1iU3Och-Lk07p=vWpkuUz7iZWpi4cEfg@mail.gmail.com","threadId":"31492","inReplyTo":"7vlighok2h.fsf@alter.siamese.dyndns.org","subject":"Re: Confirm my false error suspicions of Gitweb query injection","fromName":"Joseph Leong","fromEmail":"josephcleong@gmail.com","sentAt":"2012-09-10T17:41:35Z","receivedAt":"2012-09-10T17:41:35Z","isPatch":false,"sender":{"key":"josephcleong@gmail.com","avatar":null},"body":"and you earned bonus points for the details - thank you very much!\n\n\nOn Mon, Sep 10, 2012 at 10:37 AM, Junio C Hamano <gitster@pobox.com> wrote:\n> Joseph Leong <josephcleong@gmail.com> writes:\n>\n>> Hi Everyone,\n>>\n>> I'm using Gitweb (Based on Git 1.7.9 on RHEL 5.8).\n>>\n>> I was poking around and tried a GET Request (REQ) with some SQL\n>> statements as a search query and noticed a 500. Can i just confirm\n>> with anyone here that the error message I'm seeing in the Response\n>> (RESP) is basically saying that the search parameters are invalid\n>> because of it's funny chars are breaking the regex search and that\n>> it's not anything database related.\n>\n> Yes, I think this was fixed in v1.7.9.4 if not earlier, with e65ceb6\n> (gitweb: Fix fixed string (non-regexp) project search, 2012-03-02).\n>\n"}]}