threads / bug / 64526

[BUG] `git instaweb` and `gitweb`

Subject: [BUG] `git instaweb` and `gitweb`

## tl;dr

One message between Nov 24, 2025 and Nov 24, 2025.

replies: 0people: 1as markdown or json

windwiny· Nov 24, 2025, 13:04 UTC · lore
Hi,
 When i run `git instaweb` on a code dir, it generate .git/gitweb/ dir
and some .conf/.perl files,
and lighttpd+fastcgi read/exec those files  to serve git repo access via http.
 When dir name include `@` char ,then instaweb run ok, but gitweb.cgi
will get incorrect dir name.
 In Perl, the array variable @xx is interpolated (its value is
inserted into the string) inside a "" (double-quoted) string, but not
inside a '' (single-quoted) string.
 i write a simple patch can fix when dir include `@` char.
    --- git-instaweb.ori    Tue Sep 30 05:50:42 2025
    +++ git-instaweb        Mon Nov 24 20:53:13 2025
    @@ -716,10 +716,10 @@
     gitweb_conf() {
            cat > "$fqgitdir/gitweb/gitweb_config.perl" <<EOF
     #!/usr/bin/perl
    -our \$projectroot = "$(dirname "$fqgitdir")";
    -our \$git_temp = "$fqgitdir/gitweb/tmp";
    +our \$projectroot = '$(dirname "$fqgitdir")';
    +our \$git_temp = '$fqgitdir/gitweb/tmp';
     our \$projects_list = \$projectroot;
     \$feature{'remote_heads'}{'default'} = [1];
     EOF
Than fixed, those code still has bug:  if dir name include `'` or `"`,
 instaweb run failed.

OTHER, the instaweb generated an .perl script, gitweb exec it to read vars define, this method may cause CVE security vulnerability issues. Probably should replaced by .ini/.conf/.json

← back to recent threads