From 7dd18234861d3de62e1ddd2887f7bdb9e2b891c6 Mon Sep 17 00:00:00 2001 From: Matthias Lucas Jaros Date: Sun, 26 Oct 2025 08:39:37 +0100 Subject: Enhanced jail_escape logic and allowed also dots for repo names. Fixed - in repo names --- src/env | 4 +++- src/run | 7 ++++--- 2 files changed, 7 insertions(+), 4 deletions(-) (limited to 'src') diff --git a/src/env b/src/env index 1efd7b5..4076bf8 100644 --- a/src/env +++ b/src/env @@ -1,5 +1,7 @@ +#!/usr/bin/env fish + set _REPO_PERMISSIONS_FILE /etc/repo-permissions -set _REPO_VALIDATION_REGEX "((?:\/[a-zA-Z0-9_-]+)+.git)" +set _REPO_VALIDATION_REGEX "((?:\/[a-zA-Z0-9_\-\.]+)+.git)" set _GIT_VALIDATION_REGEX "^(git-(?:upload-pack|receive-pack|upload-archive)) '$_REPO_VALIDATION_REGEX'\$" set _GIT_SUDO_GROUP gitsudo set _LOG /var/log/run.txt diff --git a/src/run b/src/run index 4e95098..360244c 100755 --- a/src/run +++ b/src/run @@ -19,10 +19,11 @@ set -l repo $matcher[2] # adjust repo path to /srv/repos set -l repoDir /(string join -n '/' srv repos (string split '/' $repo)) -# check repo jail in /srv/repos -if not string match -r -q -- "/srv/repos/.*" "(realpath $repoDir)" +# check if realPath is in jail under /srv/repos +set -l realPath (realpath $repoDir) +if not string match -r -q -- "/srv/repos/.*" "$realPath" # something is for sure wrong here - echo "$(date -Is): DENY jail_escape user=$currentUser ip=$SSH_CONNECTION argv=$argv" &>>$_LOG + echo "$(date -Is): DENY jail_escape user=$currentUser ip=$SSH_CONNECTION realPath=$realPath argv=$argv" &>>$_LOG exit 2 end -- cgit v1.3.1