[PATCH] Permit a wider range of repository names in jgit daemon requests

From

Shawn O. Pearce <spearce@spearce.org>

Date

Jan 5, 2009, 02:46 UTC

Message-ID

<20090105024622.GC20973@spearce.org>

In-Reply-To

<200901040048.01520.robin.rosenberg@dewire.com>

Signed-off-by: Shawn O. Pearce <spearce@spearce.org>
---
  Robin Rosenberg <robin.rosenberg@dewire.com> wrote:
  > tisdag 23 december 2008 01:27:23 skrev Shawn O. Pearce:
  > > +	private static final Pattern SAFE_REPOSITORY_NAME = Pattern
  > > +			.compile("^[A-Za-z][A-Za-z0-9/_ -]+(\\.git)?$");
  > 
  > This restriction is too strict. Wouldn't any path not containing ".." be valid? In particular this did not work with my "EGIT.contrib" repo. I
  > have a lot of repos with names llike "name.purpose". Just adding
  > '.' to the character set isn't really enough.

  Yup.
  
 .../src/org/spearce/jgit/transport/Daemon.java     |   42 +++++++++----------
 1 files changed, 20 insertions(+), 22 deletions(-)

diff --git a/org.spearce.jgit/src/org/spearce/jgit/transport/Daemon.java b/org.spearce.jgit/src/org/spearce/jgit/transport/Daemon.java
index 646c88d..d39fd04 100644
--- a/org.spearce.jgit/src/org/spearce/jgit/transport/Daemon.java
+++ b/org.spearce.jgit/src/org/spearce/jgit/transport/Daemon.java
@@ -51,7 +51,6 @@
 import java.util.Collection;
 import java.util.HashMap;
 import java.util.Map;
-import java.util.regex.Pattern;
 
 import org.spearce.jgit.lib.Repository;
 
@@ -62,9 +61,6 @@
 
 	private static final int BACKLOG = 5;
 
-	private static final Pattern SAFE_REPOSITORY_NAME = Pattern
-			.compile("^[A-Za-z][A-Za-z0-9/_ -]+(\\.git)?$");
-
 	private InetSocketAddress myAddress;
 
 	private final DaemonService[] services;
@@ -292,24 +288,26 @@ synchronized (exports) {
 				return db;
 		}
 
-		if (SAFE_REPOSITORY_NAME.matcher(name).matches()) {
-			final File[] search;
-			synchronized (exportBase) {
-				search = exportBase.toArray(new File[exportBase.size()]);
-			}
-			for (final File f : search) {
-				db = openRepository(new File(f, name));
-				if (db != null)
-					return db;
-
-				db = openRepository(new File(f, name + ".git"));
-				if (db != null)
-					return db;
-
-				db = openRepository(new File(f, name + "/.git"));
-				if (db != null)
-					return db;
-			}
+		if (name.startsWith("../") || name.contains("/../")
+				|| name.contains("\\"))
+			return null;
+
+		final File[] search;
+		synchronized (exportBase) {
+			search = exportBase.toArray(new File[exportBase.size()]);
+		}
+		for (final File f : search) {
+			db = openRepository(new File(f, name));
+			if (db != null)
+				return db;
+
+			db = openRepository(new File(f, name + ".git"));
+			if (db != null)
+				return db;
+
+			db = openRepository(new File(f, name + "/.git"));
+			if (db != null)
+				return db;
 		}
 		return null;
 	}

-- 
1.6.1.94.g9388

-- 
Shawn.