commit e705ed86a3c67b13fcfc88848b55bde828f36b9e · kot.pink/core

+35 -10

appview/state/state.go

···

       601
        
       func (s *State) RemoveMember(w http.ResponseWriter, r *http.Request) {

     

       602
        
       }

     

       603
        
       

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       604
        
       func (s *State) NewRepo(w http.ResponseWriter, r *http.Request) {

     

       605
        
       	ctx, span := s.t.TraceStart(r.Context(), "NewRepo")

     

       606
        
       	defer span.End()

     
···

       643
        
       		}

     

       644
        
       		span.SetAttributes(attribute.String("repo.name", repoName))

     

       645
        
       

     

       646
       -
       		// Check for valid repository name (GitHub-like rules)

     

       647
       -
       		// No spaces, only alphanumeric characters, dashes, and underscores

     

       648
       -
       		for _, char := range repoName {

     

       649
       -
       			if !((char >= 'a' && char <= 'z') ||

     

       650
       -
       				(char >= 'A' && char <= 'Z') ||

     

       651
       -
       				(char >= '0' && char <= '9') ||

     

       652
       -
       				char == '-' || char == '_' || char == '.') {

     

       653
       -
       				s.pages.Notice(w, "repo", "Repository name can only contain alphanumeric characters, periods, hyphens, and underscores.")

     

       654
       -
       				return

     

       655
       -
       			}

     

       656
        
       		}

     

       657
        
       

     

       658
        
       		defaultBranch := r.FormValue("branch")

···

       601
        
       func (s *State) RemoveMember(w http.ResponseWriter, r *http.Request) {

     

       602
        
       }

     

       603
        
       

     

       604
       +
       func validateRepoName(name string) error {

     

       605
       +
       	// check for path traversal attempts

     

       606
       +
       	if name == "." || name == ".." ||

     

       607
       +
       		strings.Contains(name, "/") || strings.Contains(name, "\\") {

     

       608
       +
       		return fmt.Errorf("Repository name contains invalid path characters")

     

       609
       +
       	}

     

       610
       +
       

     

       611
       +
       	// check for sequences that could be used for traversal when normalized

     

       612
       +
       	if strings.Contains(name, "./") || strings.Contains(name, "../") ||

     

       613
       +
       		strings.HasPrefix(name, ".") || strings.HasSuffix(name, ".") {

     

       614
       +
       		return fmt.Errorf("Repository name contains invalid path sequence")

     

       615
       +
       	}

     

       616
       +
       

     

       617
       +
       	// then continue with character validation

     

       618
       +
       	for _, char := range name {

     

       619
       +
       		if !((char >= 'a' && char <= 'z') ||

     

       620
       +
       			(char >= 'A' && char <= 'Z') ||

     

       621
       +
       			(char >= '0' && char <= '9') ||

     

       622
       +
       			char == '-' || char == '_' || char == '.') {

     

       623
       +
       			return fmt.Errorf("Repository name can only contain alphanumeric characters, periods, hyphens, and underscores")

     

       624
       +
       		}

     

       625
       +
       	}

     

       626
       +
       

     

       627
       +
       	// additional check to prevent multiple sequential dots

     

       628
       +
       	if strings.Contains(name, "..") {

     

       629
       +
       		return fmt.Errorf("Repository name cannot contain sequential dots")

     

       630
       +
       	}

     

       631
       +
       

     

       632
       +
       	// if all checks pass

     

       633
       +
       	return nil

     

       634
       +
       }

     

       635
       +
       

     

       636
        
       func (s *State) NewRepo(w http.ResponseWriter, r *http.Request) {

     

       637
        
       	ctx, span := s.t.TraceStart(r.Context(), "NewRepo")

     

       638
        
       	defer span.End()

     
···

       675
        
       		}

     

       676
        
       		span.SetAttributes(attribute.String("repo.name", repoName))

     

       677
        
       

     

       678
       +
       		if err := validateRepoName(repoName); err != nil {

     

       679
       +
       			s.pages.Notice(w, "repo", err.Error())

     

       680
       +
       			return

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       681
        
       		}

     

       682
        
       

     

       683
        
       		defaultBranch := r.FormValue("branch")