From 40cb106198d40ed2957f93af233b721349a3e209 Mon Sep 17 00:00:00 2001 From: Joe Chen Date: Sun, 8 Dec 2024 21:12:55 -0500 Subject: [PATCH] repo/editor: disallow editing symlink while changing file name (#7857) ## Describe the pull request Link to the issue: https://github.com/gogs/gogs/issues/7582 --- internal/route/repo/editor.go | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/internal/route/repo/editor.go b/internal/route/repo/editor.go index bc9e30de7..ac1e19ccd 100644 --- a/internal/route/repo/editor.go +++ b/internal/route/repo/editor.go @@ -192,6 +192,7 @@ func editFilePost(c *context.Context, f form.EditRepoFile, isNewFile bool) { return } } else { + // 🚨 SECURITY: Do not allow editing if the target file is a symlink. if entry.IsSymlink() { c.FormErr("TreePath") c.RenderWithErr(c.Tr("repo.editor.file_is_a_symlink", part), tmplEditorEdit, &f) @@ -205,7 +206,7 @@ func editFilePost(c *context.Context, f form.EditRepoFile, isNewFile bool) { } if !isNewFile { - _, err := c.Repo.Commit.TreeEntry(oldTreePath) + entry, err := c.Repo.Commit.TreeEntry(oldTreePath) if err != nil { if gitutil.IsErrRevisionNotExist(err) { c.FormErr("TreePath") @@ -215,6 +216,14 @@ func editFilePost(c *context.Context, f form.EditRepoFile, isNewFile bool) { } return } + + // 🚨 SECURITY: Do not allow editing if the old file is a symlink. + if entry.IsSymlink() { + c.FormErr("TreePath") + c.RenderWithErr(c.Tr("repo.editor.file_is_a_symlink", oldTreePath), tmplEditorEdit, &f) + return + } + if lastCommit != c.Repo.CommitID { files, err := c.Repo.Commit.FilesChangedAfter(lastCommit) if err != nil {