diff options
author | Frank Lichtenheld <frank@lichtenheld.de> | 2007-06-07 16:57:00 +0200 |
---|---|---|
committer | Junio C Hamano <gitster@pobox.com> | 2007-06-08 02:37:18 -0700 |
commit | 4890888d742e12044b1f4b89a5d10437a6371253 (patch) | |
tree | 5ce676c9858b831e5e52fa4a22be9613e6f525ed /git-cvsserver.perl | |
parent | 225696af2ceaa2e06345954003eda742a76c4e0a (diff) | |
download | git-4890888d742e12044b1f4b89a5d10437a6371253.tar.gz |
cvsserver: Make req_Root more critical of its input data
The path submitted with the Root request has to be absolute
(cvs does it this way and it may save us some sanity checks
later)
If multiple roots are specified (e.g. because we use
pserver authentication which will already include the
root), ensure that they say all the same.
Probably neither is a security risk, and neither should ever
be triggered by a sane client, but when validating
input data, it's better to be save than sorry.
Signed-off-by: Frank Lichtenheld <frank@lichtenheld.de>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
Diffstat (limited to 'git-cvsserver.perl')
-rwxr-xr-x | git-cvsserver.perl | 11 |
1 files changed, 11 insertions, 0 deletions
diff --git a/git-cvsserver.perl b/git-cvsserver.perl index 2b4825a8ee..d41b29f30b 100755 --- a/git-cvsserver.perl +++ b/git-cvsserver.perl @@ -167,6 +167,17 @@ sub req_Root my ( $cmd, $data ) = @_; $log->debug("req_Root : $data"); + unless ($data =~ m#^/#) { + print "error 1 Root must be an absolute pathname\n"; + return 0; + } + + if ($state->{CVSROOT} + && ($state->{CVSROOT} ne $data)) { + print "error 1 Conflicting roots specified\n"; + return 0; + } + $state->{CVSROOT} = $data; $ENV{GIT_DIR} = $state->{CVSROOT} . "/"; |