From: Junio C Hamano <junkio@cox.net>
Date: Mon, 21 Nov 2005 09:28:07 GMT
Subject: Re: [PATCH 5/5] git-daemon support for user-relative paths.
Message-ID: <7vfypquz88.fsf@assigned-by-dhcp.cox.net>
In-Reply-To: <437E67AC.2010400@op5.se>

Andreas Ericsson <ae@op5.se> writes:

> I'll run the clone/fetch/push test-suite again tomorrow, with this 
> applied. It looks good though.

Sorry, but there was a thinko in my butchered version of
enter_repo().  While allowing only absolute path was good for
the version with your daemon.c change, it was not with the
current one that runs upload-pack with "." as repo.  In either
case we _do_ chdir() to it after validating the path, so I am
wondering if it is a good idea to keep sending "." as repo when
executing upload-pack with this patch as well.  This does not
make any practical difference, but I think it makes the intent
clearer -- "we are already there so do not try going anywhere
else".

So I am thinking about applying something like this patch
on top of the last part of your patch.

 - Do validation only on canonicalized paths;
 - Run upload-pack with "." as repo, not full path;
 - allow trailing slash under --strict-paths i.e. "git://host/my/repo.git/"

What do you think?

---

diff --git a/daemon.c b/daemon.c
index ac4c94b..21d8260 100644
--- a/daemon.c
+++ b/daemon.c
@@ -93,22 +93,19 @@ static char *path_ok(char *dir)
 
 	if ( ok_paths && *ok_paths ) {
 		char **pp = NULL;
-		int dirlen = strlen(dir);
 		int pathlen = strlen(path);
 
+		/* The validation is done on the paths after enter_repo
+		 * canonicalization, so whitelist should be written in
+		 * terms of real pathnames (i.e. after ~user is expanded
+		 * and symlinks resolved).
+		 */
 		for ( pp = ok_paths ; *pp ; pp++ ) {
 			int len = strlen(*pp);
-			/* because of symlinks we must match both what the
-			 * user passed and the canonicalized path, otherwise
-			 * the user can send a string matching either a whitelist
-			 * entry or an actual directory exactly and still not
-			 * get through */
 			if (len <= pathlen && !memcmp(*pp, path, len)) {
-				if (path[len] == '\0' || (!strict_paths && path[len] == '/'))
-					return path;
-			}
-			if (len <= dirlen && !memcmp(*pp, dir, len)) {
-				if (dir[len] == '\0' || (!strict_paths && dir[len] == '/'))
+				if (path[len] == '\0' ||
+				    (path[len] == '/' &&
+				     (!strict_paths || path[len+1] == 0)))
 					return path;
 			}
 		}
@@ -160,7 +157,7 @@ static int upload(char *dir)
 	snprintf(timeout_buf, sizeof timeout_buf, "--timeout=%u", timeout);
 
 	/* git-upload-pack only ever reads stuff, so this is safe */
-	execlp("git-upload-pack", "git-upload-pack", "--strict", timeout_buf, path, NULL);
+	execlp("git-upload-pack", "git-upload-pack", "--strict", timeout_buf, ".", NULL);
 	return -1;
 }