diff options
| author |  Matthias Lucas Jaros <jarlucmat@mailbox.org> | 2025-10-26 08:39:37 +0100 |
|---|---|---|
| committer | Matthias Lucas Jaros <jarlucmat@mailbox.org> | 2025-10-26 08:39:37 +0100 |
| commit | 7dd18234861d3de62e1ddd2887f7bdb9e2b891c6 (patch) | |
| tree | d03c6c7ea6303e21c212ce4fc5723b565c0ef781 | |
| parent | 80b4d4065fe7cd259d767b4439db7ed0da23880a (diff) | |
Enhanced jail_escape logic and allowed also dots for repo names. Fixed - in repo names
| -rw-r--r-- | docker-compose.yml | 1 | ||||
| -rw-r--r-- | src/env | 4 | ||||
| -rwxr-xr-x | src/run | 7 |
3 files changed, 8 insertions, 4 deletions
diff --git a/docker-compose.yml b/docker-compose.yml index ae015bd..e541cbe 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -12,6 +12,7 @@ services: - USER_handy=handy:ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBPsl91WPAT8aWwZ6y5WAfXU9PoHzxJ3YG9uFgSmlGQr2HwV+gL/XaTBJ4Brj+pa+R7tfYEBMi+7Navx/ZsEmr9E= mj@xps15 - USER_yolo=yolo:ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBPsl91WPAT8aWwZ6y5WAfXU9PoHzxJ3YG9uFgSmlGQr2HwV+gL/XaTBJ4Brj+pa+R7tfYEBMi+7Navx/ZsEmr9E= mj@xps15 - REPO_pass=/pass.git:handy + - REPO_test=/test-test.git:handy volumes: - ./donotsync/ssh:/var/ssh - ./donotsync/repos:/srv/repos @@ -1,5 +1,7 @@ +#!/usr/bin/env fish + set _REPO_PERMISSIONS_FILE /etc/repo-permissions -set _REPO_VALIDATION_REGEX "((?:\/[a-zA-Z0-9_-]+)+.git)" +set _REPO_VALIDATION_REGEX "((?:\/[a-zA-Z0-9_\-\.]+)+.git)" set _GIT_VALIDATION_REGEX "^(git-(?:upload-pack|receive-pack|upload-archive)) '$_REPO_VALIDATION_REGEX'\$" set _GIT_SUDO_GROUP gitsudo set _LOG /var/log/run.txt @@ -19,10 +19,11 @@ set -l repo $matcher[2] # adjust repo path to /srv/repos set -l repoDir /(string join -n '/' srv repos (string split '/' $repo)) -# check repo jail in /srv/repos -if not string match -r -q -- "/srv/repos/.*" "(realpath $repoDir)" +# check if realPath is in jail under /srv/repos +set -l realPath (realpath $repoDir) +if not string match -r -q -- "/srv/repos/.*" "$realPath" # something is for sure wrong here - echo "$(date -Is): DENY jail_escape user=$currentUser ip=$SSH_CONNECTION argv=$argv" &>>$_LOG + echo "$(date -Is): DENY jail_escape user=$currentUser ip=$SSH_CONNECTION realPath=$realPath argv=$argv" &>>$_LOG exit 2 end |