commit bea52ff5f17a1c7e7da6e2e1434afd0ba65aa1a1 · nel.pet/core

+1 -1

flake.nix

···

       49
        
           inherit (gitignore.lib) gitignoreSource;

     

       50
        
         in {

     

       51
        
           overlays.default = final: prev: let

     

       52
       -
             goModHash = "sha256-CmBuvv3duQQoc8iTW4244w1rYLGeqMQS+qQ3wwReZZg=";

     

       53
        
             buildCmdPackage = name:

     

       54
        
               final.buildGoModule {

     

       55
        
                 pname = name;

···

       49
        
           inherit (gitignore.lib) gitignoreSource;

     

       50
        
         in {

     

       51
        
           overlays.default = final: prev: let

     

       52
       +
             goModHash = "sha256-mCn5yrqWTVd2UTZibGcMHClIGQOTossj69iRruXiCuw=";

     

       53
        
             buildCmdPackage = name:

     

       54
        
               final.buildGoModule {

     

       55
        
                 pname = name;

+38

knotserver/routes.go

···

       600
        
       	name := data.Name

     

       601
        
       	defaultBranch := data.DefaultBranch

     

       602
        
       

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       603
        
       	relativeRepoPath := filepath.Join(did, name)

     

       604
        
       	repoPath, _ := securejoin.SecureJoin(h.c.Repo.ScanPath, relativeRepoPath)

     

       605
        
       	err := git.InitBare(repoPath, defaultBranch)

     
···

       1078
        
       func (h *Handle) Health(w http.ResponseWriter, r *http.Request) {

     

       1079
        
       	w.Write([]byte("ok"))

     

       1080
        
       }

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0

···

       600
        
       	name := data.Name

     

       601
        
       	defaultBranch := data.DefaultBranch

     

       602
        
       

     

       603
       +
       	if err := validateRepoName(name); err != nil {

     

       604
       +
       		l.Error("creating repo", "error", err.Error())

     

       605
       +
       		writeError(w, err.Error(), http.StatusBadRequest)

     

       606
       +
       		return

     

       607
       +
       	}

     

       608
       +
       

     

       609
        
       	relativeRepoPath := filepath.Join(did, name)

     

       610
        
       	repoPath, _ := securejoin.SecureJoin(h.c.Repo.ScanPath, relativeRepoPath)

     

       611
        
       	err := git.InitBare(repoPath, defaultBranch)

     
···

       1084
        
       func (h *Handle) Health(w http.ResponseWriter, r *http.Request) {

     

       1085
        
       	w.Write([]byte("ok"))

     

       1086
        
       }

     

       1087
       +
       

     

       1088
       +
       func validateRepoName(name string) error {

     

       1089
       +
       	// check for path traversal attempts

     

       1090
       +
       	if name == "." || name == ".." ||

     

       1091
       +
       		strings.Contains(name, "/") || strings.Contains(name, "\\") {

     

       1092
       +
       		return fmt.Errorf("Repository name contains invalid path characters")

     

       1093
       +
       	}

     

       1094
       +
       

     

       1095
       +
       	// check for sequences that could be used for traversal when normalized

     

       1096
       +
       	if strings.Contains(name, "./") || strings.Contains(name, "../") ||

     

       1097
       +
       		strings.HasPrefix(name, ".") || strings.HasSuffix(name, ".") {

     

       1098
       +
       		return fmt.Errorf("Repository name contains invalid path sequence")

     

       1099
       +
       	}

     

       1100
       +
       

     

       1101
       +
       	// then continue with character validation

     

       1102
       +
       	for _, char := range name {

     

       1103
       +
       		if !((char >= 'a' && char <= 'z') ||

     

       1104
       +
       			(char >= 'A' && char <= 'Z') ||

     

       1105
       +
       			(char >= '0' && char <= '9') ||

     

       1106
       +
       			char == '-' || char == '_' || char == '.') {

     

       1107
       +
       			return fmt.Errorf("Repository name can only contain alphanumeric characters, periods, hyphens, and underscores")

     

       1108
       +
       		}

     

       1109
       +
       	}

     

       1110
       +
       

     

       1111
       +
       	// additional check to prevent multiple sequential dots

     

       1112
       +
       	if strings.Contains(name, "..") {

     

       1113
       +
       		return fmt.Errorf("Repository name cannot contain sequential dots")

     

       1114
       +
       	}

     

       1115
       +
       

     

       1116
       +
       	// if all checks pass

     

       1117
       +
       	return nil

     

       1118
       +
       }