summaryrefslogtreecommitdiff
path: root/path.c
diff options
context:
space:
mode:
authorJunio C Hamano <junkio@cox.net>2005-11-18 14:59:34 -0800
committerJunio C Hamano <junkio@cox.net>2005-11-19 20:50:38 -0800
commit0870ca7fabe6f25095431280e480859f7c66e8ab (patch)
treebd8c24b3a1b2fe52baa3c9474ea6cefec209bedf /path.c
parent54f4b87454824fedc629219620ce9b7cdcab3d27 (diff)
downloadgit-0870ca7fabe6f25095431280e480859f7c66e8ab.tar.gz
Do not DWIM in userpath library under strict mode.
This should force git-daemon administrator's job a bit harder because the exact paths need to be given in the whitelist, but at the same time makes the auditing easier. This moves validate_symref() from refs.c to path.c, because we need to link path.c with git-daemon for its "enter_repo()", but we do not want to link the daemon with the rest of git libraries and its requirements. Signed-off-by: Junio C Hamano <junkio@cox.net>
Diffstat (limited to 'path.c')
-rw-r--r--path.c77
1 files changed, 60 insertions, 17 deletions
diff --git a/path.c b/path.c
index 5b617092ad..d635470de1 100644
--- a/path.c
+++ b/path.c
@@ -91,20 +91,55 @@ char *safe_strncpy(char *dest, const char *src, size_t n)
return dest;
}
+int validate_symref(const char *path)
+{
+ struct stat st;
+ char *buf, buffer[256];
+ int len, fd;
+
+ if (lstat(path, &st) < 0)
+ return -1;
+
+ /* Make sure it is a "refs/.." symlink */
+ if (S_ISLNK(st.st_mode)) {
+ len = readlink(path, buffer, sizeof(buffer)-1);
+ if (len >= 5 && !memcmp("refs/", buffer, 5))
+ return 0;
+ return -1;
+ }
+
+ /*
+ * Anything else, just open it and try to see if it is a symbolic ref.
+ */
+ fd = open(path, O_RDONLY);
+ if (fd < 0)
+ return -1;
+ len = read(fd, buffer, sizeof(buffer)-1);
+ close(fd);
+
+ /*
+ * Is it a symbolic ref?
+ */
+ if (len < 4 || memcmp("ref:", buffer, 4))
+ return -1;
+ buf = buffer + 4;
+ len -= 4;
+ while (len && isspace(*buf))
+ buf++, len--;
+ if (len >= 5 && !memcmp("refs/", buf, 5))
+ return 0;
+ return -1;
+}
+
static char *current_dir()
{
return getcwd(pathname, sizeof(pathname));
}
-/* Take a raw path from is_git_repo() and canonicalize it using Linus'
- * idea of a blind chdir() and getcwd(). */
-static const char *canonical_path(char *path, int strict)
+static int user_chdir(char *path)
{
char *dir = path;
- if(strict && *dir != '/')
- return NULL;
-
if(*dir == '~') { /* user-relative path */
struct passwd *pw;
char *slash = strchr(dir, '/');
@@ -125,19 +160,19 @@ static const char *canonical_path(char *path, int strict)
/* make sure we got something back that we can chdir() to */
if(!pw || chdir(pw->pw_dir) < 0)
- return NULL;
+ return -1;
if(!slash || !slash[1]) /* no path following username */
- return current_dir();
+ return 0;
dir = slash + 1;
}
/* ~foo/path/to/repo is now path/to/repo and we're in foo's homedir */
if(chdir(dir) < 0)
- return NULL;
+ return -1;
- return current_dir();
+ return 0;
}
char *enter_repo(char *path, int strict)
@@ -145,16 +180,24 @@ char *enter_repo(char *path, int strict)
if(!path)
return NULL;
- if(!canonical_path(path, strict)) {
- if(strict || !canonical_path(mkpath("%s.git", path), strict))
+ if (strict) {
+ if((path[0] != '/') || chdir(path) < 0)
return NULL;
}
+ else {
+ if (!*path)
+ ; /* happy -- no chdir */
+ else if (!user_chdir(path))
+ ; /* happy -- as given */
+ else if (!user_chdir(mkpath("%s.git", path)))
+ ; /* happy -- uemacs --> uemacs.git */
+ else
+ return NULL;
+ (void)chdir(".git");
+ }
- /* This is perfectly safe, and people tend to think of the directory
- * where they ran git-init-db as their repository, so humour them. */
- (void)chdir(".git");
-
- if(access("objects", X_OK) == 0 && access("refs", X_OK) == 0) {
+ if(access("objects", X_OK) == 0 && access("refs", X_OK) == 0 &&
+ validate_symref("HEAD") == 0) {
putenv("GIT_DIR=.");
return current_dir();
}