From 77a4a945ae9a87f77e392e9066b560edb71b5de9 Mon Sep 17 00:00:00 2001 From: Joe Chen Date: Sun, 22 Dec 2024 15:24:18 -0500 Subject: [PATCH] repo: prevent preview and delete files in `.git` directories (#7870) ## Describe the pull request Fixes https://github.com/gogs/gogs/security/advisories/GHSA-ccqv-43vm-4f3w --- internal/database/repo_editor.go | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/internal/database/repo_editor.go b/internal/database/repo_editor.go index c0be2528d..1ea436f8a 100644 --- a/internal/database/repo_editor.go +++ b/internal/database/repo_editor.go @@ -220,6 +220,11 @@ func (repo *Repository) UpdateRepoFile(doer *User, opts UpdateRepoFileOptions) ( // GetDiffPreview produces and returns diff result of a file which is not yet committed. func (repo *Repository) GetDiffPreview(branch, treePath, content string) (diff *gitutil.Diff, err error) { + // 🚨 SECURITY: Prevent uploading files into the ".git" directory + if isRepositoryGitPath(treePath) { + return nil, errors.Errorf("bad tree path %q", treePath) + } + repoWorkingPool.CheckIn(com.ToStr(repo.ID)) defer repoWorkingPool.CheckOut(com.ToStr(repo.ID)) @@ -283,6 +288,11 @@ type DeleteRepoFileOptions struct { } func (repo *Repository) DeleteRepoFile(doer *User, opts DeleteRepoFileOptions) (err error) { + // 🚨 SECURITY: Prevent uploading files into the ".git" directory + if isRepositoryGitPath(opts.TreePath) { + return errors.Errorf("bad tree path %q", opts.TreePath) + } + repoWorkingPool.CheckIn(com.ToStr(repo.ID)) defer repoWorkingPool.CheckOut(com.ToStr(repo.ID))