Re: [JGIT PATCH] Permit a wider range of repository names in jgit daemon requests

From: Robin Rosenberg <robin.rosenberg@dewire.com>
Date: Feb 9, 2009, 07:47 UTC
Message-ID: <200902090847.40905.robin.rosenberg@dewire.com>
In-Reply-To: <1234151883-30479-1-git-send-email-spearce@spearce.org>

måndag 09 februari 2009 04:58:03 skrev du:

Show 8 quoted lines

> The earlier restriction was too narrow for some applications, for
> example repositories named "jgit.dev" and "jgit.test" are perfectly
> valid Git repositories and should still be able to be served by
> the daemon.
> 
> By blocking out only uses of ".." as a path component and Windows
> UNC paths (by blocking "\") we can reasonably prevent the client
> from escaping the base dirctories configured in the daemon.

Didn't I tell you // is also UNC-prefix? Windows treats / == \ at the API level. Also why test for contains one "\"? And why in the middle? The UNC prefix can only occur at the beginning of a path. You can use File.isAbsolute to see if a name represents an absolute path. It is platform-depdendent, so new File("//foo/bar").isAbsolute() yield different results on Windows and unix platforms.

-- robin