diff options
| author |  Matthias Jaros <jarlucmat@mailbox.org> | 2026-08-19 16:25:37 +0200 |
|---|---|---|
| committer | Matthias Jaros <jarlucmat@mailbox.org> | 2026-08-19 16:47:31 +0200 |
| commit | f5504097d722f52f0a2ec275e71fb7254ac8c6be (patch) | |
| tree | 07850df63c0854f404c4ccdb6f64390dc7c6bf6a | |
| parent | a0aa4f06888810ca6692028c761f139848dcf9a2 (diff) | |
Added another check to secure path of repo does not contain any funky .
| -rwxr-xr-x | src/git-run | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/src/git-run b/src/git-run index 87f6155..10dd3b7 100755 --- a/src/git-run +++ b/src/git-run @@ -36,6 +36,10 @@ end function verifyRepoJail set -l realPath (realpath $repoDir) + if test "$realPath" != "$repoDir" + emit log DENY jail_escape "realPath!=repoDir -> $realpath!=$repoDir" + return 2 + end if not string match -r -q -- "/srv/repos/.*" "$realPath" emit log DENY jail_escape "realPath=$realPath" return 2 |