From f5504097d722f52f0a2ec275e71fb7254ac8c6be Mon Sep 17 00:00:00 2001
From: Matthias Jaros <jarlucmat@mailbox.org>
Date: Wed, 19 Aug 2026 16:25:37 +0200
Subject: Added another check to secure path of repo does not contain any funky
 .

---
 src/git-run | 4 ++++
 1 file changed, 4 insertions(+)

(limited to 'src')

diff --git a/src/git-run b/src/git-run
index 87f6155..10dd3b7 100755
--- a/src/git-run
+++ b/src/git-run
@@ -36,6 +36,10 @@ end
 
 function verifyRepoJail
 	set -l realPath (realpath $repoDir)
+	if test "$realPath" != "$repoDir"
+		emit log DENY jail_escape "realPath!=repoDir -> $realpath!=$repoDir"
+		return 2
+	end
 	if not string match -r -q -- "/srv/repos/.*" "$realPath"
 		emit log DENY jail_escape "realPath=$realPath"
 		return 2
-- 
cgit v1.3.1