USEFULL/gogs
1
0
Fork 0
mirror of https://github.com/gogs/gogs.git synced 2025-09-04 19:37:58 +00:00
Code Issues Packages Projects Releases Wiki Activity

security: fix path cleanup for repository init and editor (#5207)

Browse Source 
Reported by Kacper Szurek https://security.szurek.pl/.
This commit is contained in:
Lauris BH 2018-05-08 21:32:49 +03:00 committed by 无闻
parent 2fabcd0455
commit eccc8109c1
3 changed files with 4 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
models/repo.go
View File

@ -854,7 +854,7 @@ type CreateRepoOptions struct {
} }
func getRepoInitFile(tp, name string) ([]byte, error) { func getRepoInitFile(tp, name string) ([]byte, error) {
relPath := path.Join("conf", tp, strings.TrimLeft(name, "./")) relPath := path.Join("conf", tp, strings.TrimLeft(path.Clean("/"+name), "/"))
// Use custom file when available. // Use custom file when available.
customPath := path.Join(setting.CustomPath, relPath) customPath := path.Join(setting.CustomPath, relPath)

2
models/wiki.go
View File

@ -33,7 +33,7 @@ func ToWikiPageURL(name string) string {
// that are not belong to wiki repository. // that are not belong to wiki repository.
func ToWikiPageName(urlString string) string { func ToWikiPageName(urlString string) string {
name, _ := url.QueryUnescape(urlString) name, _ := url.QueryUnescape(urlString)
return strings.Replace(strings.TrimLeft(name, "./"), "/", " ", -1) return strings.Replace(strings.TrimLeft(path.Clean("/"+name), "/"), "/", " ", -1)
} }
// WikiCloneLink returns clone URLs of repository wiki. // WikiCloneLink returns clone URLs of repository wiki.

4
routes/repo/editor.go
View File

@ -140,7 +140,7 @@ func editFilePost(c *context.Context, f form.EditRepoFile, isNewFile bool) {
branchName = f.NewBranchName branchName = f.NewBranchName
} }
f.TreePath = strings.Trim(f.TreePath, " /") f.TreePath = strings.Trim(path.Clean("/"+f.TreePath), " /")
treeNames, treePaths := getParentTreeFields(f.TreePath) treeNames, treePaths := getParentTreeFields(f.TreePath)
c.Data["ParentTreePath"] = path.Dir(c.Repo.TreePath) c.Data["ParentTreePath"] = path.Dir(c.Repo.TreePath)
@ -431,7 +431,7 @@ func UploadFilePost(c *context.Context, f form.UploadRepoFile) {
branchName = f.NewBranchName branchName = f.NewBranchName
} }
f.TreePath = strings.Trim(f.TreePath, " /") f.TreePath = strings.Trim(path.Clean("/"+f.TreePath), " /")
treeNames, treePaths := getParentTreeFields(f.TreePath) treeNames, treePaths := getParentTreeFields(f.TreePath)
if len(treeNames) == 0 { if len(treeNames) == 0 {
// We must at least have one element for user to input. // We must at least have one element for user to input.