git/list[1] front-page[2] threads[3] people[4] search[5] about
 

Re: Confirm my false error suspicions of Gitweb query injection

From
Junio C Hamano <gitster@pobox.com>
Date
Sep 10, 2012, 17:37 UTC
Message-ID
<7vlighok2h.fsf@alter.siamese.dyndns.org>
In-Reply-To
<CAMOg_eUjmnisevN+AaArz+6TMpWYJL660xwG0ptEaTO7stcL6A@mail.gmail.com>
Joseph Leong <josephcleong@gmail.com> writes:
Show 10 quoted lines
> Hi Everyone,
>
> I'm using Gitweb (Based on Git 1.7.9 on RHEL 5.8).
>
> I was poking around and tried a GET Request (REQ) with some SQL
> statements as a search query and noticed a 500. Can i just confirm
> with anyone here that the error message I'm seeing in the Response
> (RESP) is basically saying that the search parameters are invalid
> because of it's funny chars are breaking the regex search and that
> it's not anything database related.

Yes, I think this was fixed in v1.7.9.4 if not earlier, with e65ceb6 (gitweb: Fix fixed string (non-regexp) project search, 2012-03-02).

Previous: Matthieu MoyNext: Joseph Leong
Message 3 of 4 in “Confirm my false error suspicions of Gitweb query injection”
  1. Joseph LeongSep 10, 2012
  2. Matthieu MoySep 10, 2012
  3. Junio C HamanoSep 10, 2012
  4. Joseph LeongSep 10, 2012

Read the whole thread, see it on lore, or plain text.

$ cat FOOTERMessages come from the public archive at lore.kernel.org/git, fetched every hour. The front page is chosen and written each morning by an AI editor and can be wrong; the threads themselves are the record. About and API. For agents: an MCP server at https://gitlist.dev/mcp, and any thread, story or person page as Markdown by adding .md to its URL (or sending Accept: text/markdown). Details in /llms.txt.