ui-ssdiff: resolve HTML5 validation errors

[cgit.git] / ui-clone.c

diff --git a/ui-clone.c b/ui-clone.c
index 2c1ac3daa8e827f49afc2f369a18456867f153b9..5dccb639761a57f8e3176c52029ab5a5e57194dc 100644 (file)
--- a/ui-clone.c
+++ b/ui-clone.c
@@ -19,12 +19,12 @@ static int print_ref_info(const char *refname, const struct object_id *oid,
 {
        struct object *obj;
 
-       if (!(obj = parse_object(oid)))
+       if (!(obj = parse_object(the_repository, oid)))
                return 0;
 
        htmlf("%s\t%s\n", oid_to_hex(oid), refname);
        if (obj->type == OBJ_TAG) {
-               if (!(obj = deref_tag(obj, refname, 0)))
+               if (!(obj = deref_tag(the_repository, obj, refname, 0)))
                        return 0;
                htmlf("%s\t%s^{}\n", oid_to_hex(&obj->oid), refname);
        }
@@ -92,17 +92,32 @@ void cgit_clone_info(void)
 
 void cgit_clone_objects(void)
 {
-       if (!ctx.qry.path) {
-               cgit_print_error_page(400, "Bad request", "Bad request");
-               return;
-       }
+       char *p;
+
+       if (!ctx.qry.path)
+               goto err;
 
        if (!strcmp(ctx.qry.path, "info/packs")) {
                print_pack_info();
                return;
        }
 
+       /* Avoid directory traversal by forbidding "..", but also work around
+        * other funny business by just specifying a fairly strict format. For
+        * example, now we don't have to stress out about the Cygwin port.
+        */
+       for (p = ctx.qry.path; *p; ++p) {
+               if (*p == '.' && *(p + 1) == '.')
+                       goto err;
+               if (!isalnum(*p) && *p != '/' && *p != '.' && *p != '-')
+                       goto err;
+       }
+
        send_file(git_path("objects/%s", ctx.qry.path));
+       return;
+
+err:
+       cgit_print_error_page(400, "Bad request", "Bad request");
 }
 
 void cgit_clone_head(void)