From: Robin Rosenberg <robin.rosenberg@dewire.com>
Date: Mon, 09 Feb 2009 07:47:40 GMT
Subject: Re: [JGIT PATCH] Permit a wider range of repository names in jgit daemon requests
Message-ID: <200902090847.40905.robin.rosenberg@dewire.com>
In-Reply-To: <1234151883-30479-1-git-send-email-spearce@spearce.org>

måndag 09 februari 2009 04:58:03 skrev du:
> The earlier restriction was too narrow for some applications, for
> example repositories named "jgit.dev" and "jgit.test" are perfectly
> valid Git repositories and should still be able to be served by
> the daemon.
> 
> By blocking out only uses of ".." as a path component and Windows
> UNC paths (by blocking "\") we can reasonably prevent the client
> from escaping the base dirctories configured in the daemon.

Didn't I tell you // is also UNC-prefix? Windows treats / == \ at the API
level. Also why test for contains one "\"? And why in the middle? The
UNC prefix can only occur at the beginning of a path. You can use
File.isAbsolute to see if a name represents an absolute path. It is
platform-depdendent, so new File("//foo/bar").isAbsolute() yield
different results on Windows and unix platforms.

-- robin