]> git.cameronkatri.com Git - cgit.git/commit
git.ckatri.com / cgit.git / commit
? search:
summary | shortlog | log | commit | commitdiff | tree
(parent: c679d90) | patch
clone: fix directory traversal
authorJason A. Donenfeld <Jason@zx2c4.com>
Fri, 3 Aug 2018 13:46:11 +0000 (15:46 +0200)
committerJason A. Donenfeld <Jason@zx2c4.com>
Fri, 3 Aug 2018 15:04:03 +0000 (17:04 +0200)
commit53efaf30b50f095cad8c160488c74bba3e3b2680
tree48c0be88bfef03400ddd4b3871baf9de9dbe0b77tree | snapshot
parentc679d9010451b986bae719a6abe0458af2b2dfb9commit | diff
clone: fix directory traversal

This was introduced in the initial version of this code, way back when
in 2008.

$ curl http://127.0.0.1/cgit/repo/objects/?path=../../../../../../../../../etc/passwd
root:x:0:0:root:/root:/bin/sh
...

Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
Reported-by: Jann Horn <jannh@google.com>
ui-clone.c diff | blob | history
A hyperfast web frontend for git repositories written in C.