# [BUG] `git instaweb` and `gitweb`

1 messages from 2025-11-24 to 2025-11-24. Participants: windwiny.
Thread: https://gitlist.dev/t/64526

## windwiny, 2025-11-24 13:04

Subject: [BUG] `git instaweb` and `gitweb`
Message-ID: <CAJ_pojYchJyC4GgPGXnPV+DvVmsHYXycEWVF5GF-1pUEM1mbug@mail.gmail.com>
URL: https://gitlist.dev/e/CAJ_pojYchJyC4GgPGXnPV%2BDvVmsHYXycEWVF5GF-1pUEM1mbug%40mail.gmail.com

```
Hi,

 When i run `git instaweb` on a code dir, it generate .git/gitweb/ dir
and some .conf/.perl files,
and lighttpd+fastcgi read/exec those files  to serve git repo access via http.

 When dir name include `@` char ,then instaweb run ok, but gitweb.cgi
will get incorrect dir name.
 In Perl, the array variable @xx is interpolated (its value is
inserted into the string) inside a "" (double-quoted) string, but not
inside a '' (single-quoted) string.

 i write a simple patch can fix when dir include `@` char.

    --- git-instaweb.ori    Tue Sep 30 05:50:42 2025
    +++ git-instaweb        Mon Nov 24 20:53:13 2025
    @@ -716,10 +716,10 @@

     gitweb_conf() {
            cat > "$fqgitdir/gitweb/gitweb_config.perl" <<EOF
     #!/usr/bin/perl
    -our \$projectroot = "$(dirname "$fqgitdir")";
    -our \$git_temp = "$fqgitdir/gitweb/tmp";
    +our \$projectroot = '$(dirname "$fqgitdir")';
    +our \$git_temp = '$fqgitdir/gitweb/tmp';
     our \$projects_list = \$projectroot;

     \$feature{'remote_heads'}{'default'} = [1];
     EOF

Than fixed, those code still has bug:  if dir name include `'` or `"`,
 instaweb run failed.

OTHER,  the instaweb generated an .perl script, gitweb exec it to read
vars define,
this method may cause CVE security vulnerability issues.
Probably should replaced by .ini/.conf/.json

```