commit 835d80d67b1b8b90409e1fc265ec817a71a410e7 parent a5f8ad879f15f8b55995a9da7e3e3c2e9a47a33f Author: Matthias Jaros <jaros@mailbox.org> Date: Sun, 16 Nov 2025 16:14:03 +0100 Removed unnecessary comments and moved parsing logic into one function Diffstat:
| M | src/git-run | | | 39 | +++++++++++++++++---------------------- |
1 file changed, 17 insertions(+), 22 deletions(-)
diff --git a/src/git-run b/src/git-run @@ -8,23 +8,31 @@ set gitCommand set repoDir set currentUser (whoami) -function log --on-event log_event +function log --on-event log echo "$(date -Is): $argv[1..2] user=$currentUser $argv[3..] ip=$SSH_CONNECTION" >> $_LOG end -function verifyGitCommand +function parseCommand + set -l matcher (string match -r -g $_GIT_VALIDATION_REGEX -- "$argv") + # check given git command # basic form is <git-command> '<path-to-repo>' - if test (count $argv) -ne 2 - emit log_event DENY bad_format "argv=$argv" + if test (count $matcher) -ne 2 + emit log DENY bad_format "argv=$argv" return 1 end + + # extract variables + set gitCommand $matcher[1] + + # adjust repo path to /srv/repos + set repoDir /(string join -n '/' srv repos (string split '/' $matcher[2])) end function verifyRepoJail set -l realPath (realpath $repoDir) if not string match -r -q -- "/srv/repos/.*" "$realPath" - emit log_event DENY jail_escape "realPath=$realPath" + emit log DENY jail_escape "realPath=$realPath" return 2 end end @@ -43,39 +51,26 @@ function verifyPermissions set permission [w] case '*' # this should not happend because we sanitize above the git command - emit log_event DENY unkown_git_command "gitCommand=$gitCommand" + emit log DENY unkown_git_command "gitCommand=$gitCommand" return 3 end # check for permissions if not cat $_REPO_PERMISSIONS_FILE | grep -q -E "^$repoDir:$currentUser:$permission\$" - emit log_event DENY no_permissions + emit log DENY no_permissions return 4 end end # redirect stdout/stderr to file, no information to potential attacker begin - # parse command - set -l parsedCommand (string match -r -g $_GIT_VALIDATION_REGEX -- "$argv") - - verifyGitCommand $parsedCommand; or exit $status - - # extract variables - set gitCommand $parsedCommand[1] - - # adjust repo path to /srv/repos - set repoDir /(string join -n '/' srv repos (string split '/' $parsedCommand[2])) + parseCommand $argv; or exit $status - # check if realPath is in jail under /srv/repos verifyRepoJail; or exit $status - # check for permissions needed verifyPermissions; or exit $status - # info logging - emit log_event ALLOW ok "argv=$argv" + emit log ALLOW ok "argv=$argv" end &>>$_LOG -# execute parsed git command exec /usr/bin/sudo -n -u git /usr/bin/git-shell -c "$gitCommand '$repoDir'" \ No newline at end of file