[PATCH] daemon: sanitize all directory separators

From

René Scharfe. <l.s.r@web.de>

Date

Mar 25, 2021, 16:21 UTC

Message-ID

<314451a4-ee8f-fb68-016f-66a4f3bea409@web.de>

Signed-off-by: René Scharfe <l.s.r@web.de>
---
 daemon.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/daemon.c b/daemon.c
index 2ab7ea82eb..0561c19ee8 100644
--- a/daemon.c
+++ b/daemon.c
@@ -566,14 +566,14 @@ static void parse_host_and_port(char *hostport, char **host,

 /*
  * Sanitize a string from the client so that it's OK to be inserted into a
- * filesystem path. Specifically, we disallow slashes, runs of "..", and
- * trailing and leading dots, which means that the client cannot escape
- * our base path via ".." traversal.
+ * filesystem path. Specifically, we disallow directory separators, runs
+ * of "..", and trailing and leading dots, which means that the client
+ * cannot escape our base path via ".." traversal.
  */
 static void sanitize_client(struct strbuf *out, const char *in)
 {
 	for (; *in; in++) {
-		if (*in == '/')
+		if (is_dir_sep(*in))
 			continue;
 		if (*in == '.' && (!out->len || out->buf[out->len - 1] == '.'))
 			continue;
--
2.30.2