forked from tangled.org/core
Monorepo for Tangled — https://tangled.org

knotserver: reject '{did}/{name}/git-receive-pack' requests

Changed files
+14
knotserver
+13
knotserver/git.go
···
}
}
+
func (d *Handle) ReceivePack(w http.ResponseWriter, r *http.Request) {
+
did := chi.URLParam(r, "did")
+
name := chi.URLParam(r, "name")
+
_, err := securejoin.SecureJoin(d.c.Repo.ScanPath, filepath.Join(did, name))
+
if err != nil {
+
gitError(w, err.Error(), http.StatusForbidden)
+
d.l.Error("git: failed to secure join repo path", "handler", "ReceivePack", "error", err)
+
return
+
}
+
+
d.RejectPush(w, r, name)
+
}
+
func (d *Handle) RejectPush(w http.ResponseWriter, r *http.Request, unqualifiedRepoName string) {
// A text/plain response will cause git to print each line of the body
// prefixed with "remote: ".
+1
knotserver/handler.go
···
r.Get("/", h.RepoIndex)
r.Get("/info/refs", h.InfoRefs)
r.Post("/git-upload-pack", h.UploadPack)
+
r.Post("/git-receive-pack", h.ReceivePack)
r.Get("/compare/{rev1}/{rev2}", h.Compare) // git diff-tree compare of two objects
r.With(h.VerifySignature).Post("/hidden-ref/{forkRef}/{remoteRef}", h.NewHiddenRef)