diff options
Diffstat (limited to 'internal')
| -rw-r--r-- | internal/pathutil/pathutil_test.go | 4 | ||||
| -rw-r--r-- | internal/route/repo/http.go | 17 |
2 files changed, 16 insertions, 5 deletions
diff --git a/internal/pathutil/pathutil_test.go b/internal/pathutil/pathutil_test.go index d20e537a..7444c82a 100644 --- a/internal/pathutil/pathutil_test.go +++ b/internal/pathutil/pathutil_test.go @@ -28,6 +28,10 @@ func TestClean(t *testing.T) { wantVal: "a/readme.txt", }, { + path: "../../objects/info/..", + wantVal: "objects", + }, + { path: "/a/readme.txt", wantVal: "a/readme.txt", }, diff --git a/internal/route/repo/http.go b/internal/route/repo/http.go index 575719f1..668c4cfa 100644 --- a/internal/route/repo/http.go +++ b/internal/route/repo/http.go @@ -24,6 +24,7 @@ import ( "gogs.io/gogs/internal/conf" "gogs.io/gogs/internal/db" "gogs.io/gogs/internal/lazyregexp" + "gogs.io/gogs/internal/pathutil" "gogs.io/gogs/internal/tool" ) @@ -408,15 +409,21 @@ func HTTP(c *HTTPContext) { } if route.method != c.Req.Method { - c.NotFound() + c.Error(http.StatusNotFound) return } - file := strings.TrimPrefix(reqPath, m[1]+"/") - dir, err := getGitRepoPath(m[1]) + cleaned := pathutil.Clean(m[1]) + if m[1] != "/"+cleaned { + c.Error(http.StatusBadRequest, "Request path contains suspicious characters") + return + } + + file := strings.TrimPrefix(reqPath, cleaned) + dir, err := getGitRepoPath(cleaned) if err != nil { log.Warn("HTTP.getGitRepoPath: %v", err) - c.NotFound() + c.Error(http.StatusNotFound) return } @@ -435,5 +442,5 @@ func HTTP(c *HTTPContext) { return } - c.NotFound() + c.Error(http.StatusNotFound) } |