git/list[1] front-page[2] threads[3] people[4] search[5] about
 

Re: [PATCH] Permit a wider range of repository names in jgit daemon requests

From
Robin Rosenberg <robin.rosenberg.lists@dewire.com>
Date
Jan 5, 2009, 23:07 UTC
Message-ID
<200901060007.43909.robin.rosenberg.lists@dewire.com>
In-Reply-To
<20090105024622.GC20973@spearce.org>
måndag 05 januari 2009 03:46:22 skrev Shawn O. Pearce:
Show 11 quoted lines
> The earlier restriction was too narrow for some applications, for
> example repositories named "jgit.dev" and "jgit.test" are perfectly
> valid Git repositories and should still be able to be served by
> the daemon.
> 
> By blocking out only uses of ".." as a path component and Windows
> UNC paths (by blocking "\") we can reasonably prevent the client
> from escaping the base dirctories configured in the daemon.
> 
> +		if (name.startsWith("../") || name.contains("/../")
> +				|| name.contains("\\"))

//host/share also works as UNC path (even the DOS commands support it, provided you quote the paths) and if you block // shuldn't '/', and '[A-Z]:' also be blocked? \\ is a UNC-prefix only at the beginning of a path so if / need not be filtered, nor does //. Inside a path \\ is the same as \ AFAIK (except directly after the drive letter. This should probablybe factored out into a utilty so we can have a simple unit test for it.

-- robin
Previous: Shawn O. Pearce
Message 17 of 17 in “Add receive-pack server side support”
  1. 00/13 Add receive-pack server side supportShawn O. Pearce, Dec 23, 2008
  2. 01/13 Fix invalid "double checked locking" in InflaterCacheShawn O. Pearce, Dec 23, 2008
  3. 02/13 Cleanup stupid release of the cached Inflater in IndexPackShawn O. Pearce, Dec 23, 2008
  4. 03/13 Cache an Inflater inside a WindowCursor and reuse it as much as possibleShawn O. Pearce, Dec 23, 2008
  5. 04/13 Make RefDatabase thread-safeShawn O. Pearce, Dec 23, 2008
  6. 05/13 Make PackFile thread-safeShawn O. Pearce, Dec 23, 2008
  7. 06/13 Make Repository thread-safeShawn O. Pearce, Dec 23, 2008
  8. 07/13 Don't open a PackFile multiple times on scanForPacksShawn O. Pearce, Dec 23, 2008
  9. 08/13 Expose RepositoryConfig.getBoolean so applications can use itShawn O. Pearce, Dec 23, 2008
  10. 09/13 Add AnyObjectId.copyTo(StringBuilder)Shawn O. Pearce, Dec 23, 2008
  11. 10/13 Add compare-and-swap semantics to RefUpdateShawn O. Pearce, Dec 23, 2008
  12. 11/13 Allow null new ObjectId during RefUpdate.deleteShawn O. Pearce, Dec 23, 2008
  13. 12/13 Implement the git-receive-pack process in JavaShawn O. Pearce, Dec 23, 2008
  14. 13/13 Add basic git daemon support to publish receive-packShawn O. Pearce, Dec 23, 2008
  15. Robin RosenbergJan 3, 2009
  16. Permit a wider range of repository names in jgit daemon requestsShawn O. Pearce, Jan 5, 2009
  17. Robin RosenbergJan 5, 2009

Read the whole thread, see it on lore, or plain text.

$ cat FOOTERMessages come from the public archive at lore.kernel.org/git, fetched every hour. The front page is chosen and written each morning by an AI editor and can be wrong; the threads themselves are the record. About and API. For agents: an MCP server at https://gitlist.dev/mcp, and any thread, story or person page as Markdown by adding .md to its URL (or sending Accept: text/markdown). Details in /llms.txt.