gitreef

commit 0a933e445a680c40e2a75b4235a2aa08545f9c17
parent 0fc67090a7df8a98ebbd62b2421d09795c1b0295
Author: Matthias Jaros <jaros@mailbox.org>
Date:   Sun, 26 Oct 2025 08:39:37 +0100

Enhanced jail_escape logic and allowed also dots for repo names. Fixed - in repo names

Diffstat:
M
docker-compose.yml
 | 
1
+
M
src/env
 | 
4
+++-
M
src/run
 | 
7
++++---

3 files changed, 8 insertions(+), 4 deletions(-)
diff --git a/docker-compose.yml b/docker-compose.yml
@@ -12,6 +12,7 @@ services:
       - USER_handy=handy:ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBPsl91WPAT8aWwZ6y5WAfXU9PoHzxJ3YG9uFgSmlGQr2HwV+gL/XaTBJ4Brj+pa+R7tfYEBMi+7Navx/ZsEmr9E= mj@xps15
       - USER_yolo=yolo:ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBPsl91WPAT8aWwZ6y5WAfXU9PoHzxJ3YG9uFgSmlGQr2HwV+gL/XaTBJ4Brj+pa+R7tfYEBMi+7Navx/ZsEmr9E= mj@xps15
       - REPO_pass=/pass.git:handy
+      - REPO_test=/test-test.git:handy
     volumes:
       - ./donotsync/ssh:/var/ssh
       - ./donotsync/repos:/srv/repos
diff --git a/src/env b/src/env
@@ -1,5 +1,7 @@
+#!/usr/bin/env fish
+
 set _REPO_PERMISSIONS_FILE /etc/repo-permissions
-set _REPO_VALIDATION_REGEX "((?:\/[a-zA-Z0-9_-]+)+.git)"
+set _REPO_VALIDATION_REGEX "((?:\/[a-zA-Z0-9_\-\.]+)+.git)"
 set _GIT_VALIDATION_REGEX "^(git-(?:upload-pack|receive-pack|upload-archive)) '$_REPO_VALIDATION_REGEX'\$"
 set _GIT_SUDO_GROUP gitsudo
 set _LOG /var/log/run.txt
diff --git a/src/run b/src/run
@@ -19,10 +19,11 @@ set -l repo $matcher[2]
 # adjust repo path to /srv/repos
 set -l repoDir /(string join -n '/' srv repos (string split '/' $repo))
 
-# check repo jail in /srv/repos
-if not string match -r -q -- "/srv/repos/.*" "(realpath $repoDir)"
+# check if realPath is in jail under /srv/repos
+set -l realPath (realpath $repoDir)
+if not string match -r -q -- "/srv/repos/.*" "$realPath"
 	# something is for sure wrong here
-	echo "$(date -Is): DENY jail_escape user=$currentUser ip=$SSH_CONNECTION argv=$argv" &>>$_LOG
+	echo "$(date -Is): DENY jail_escape user=$currentUser ip=$SSH_CONNECTION realPath=$realPath argv=$argv" &>>$_LOG
 	exit 2
 end