diff options
| author |  Junio C Hamano <gitster@pobox.com> | 2015-03-03 14:37:05 -0800 |
|---|---|---|
| committer | Junio C Hamano <gitster@pobox.com> | 2015-03-03 14:37:06 -0800 |
| commit | 4c3dbbf7225c45ab0e04953090d0ece4a15e83a2 (patch) | |
| tree | 68820f614f5c4f3b735c2eb6dd13c1e12208a6ae /t | |
| parent | Merge branch 'rs/daemon-interpolate' (diff) | |
| parent | daemon: sanitize incoming virtual hostname (diff) | |
| download | tgif-4c3dbbf7225c45ab0e04953090d0ece4a15e83a2.tar.xz | |
Merge branch 'jk/daemon-interpolate'
The "interpolated-path" option of "git daemon" inserted any string
client declared on the "host=" capability request without checking.
Sanitize and limit %H and %CH to a saner and a valid DNS name.
* jk/daemon-interpolate:
daemon: sanitize incoming virtual hostname
t5570: test git-daemon's --interpolated-path option
git_connect: let user override virtual-host we send to daemon
Diffstat (limited to 't')
| -rwxr-xr-x | t/t5570-git-daemon.sh | 27 |
1 files changed, 27 insertions, 0 deletions
diff --git a/t/t5570-git-daemon.sh b/t/t5570-git-daemon.sh index 6b16379951..b7e283252d 100755 --- a/t/t5570-git-daemon.sh +++ b/t/t5570-git-daemon.sh @@ -142,4 +142,31 @@ test_expect_success 'read access denied' "test_remote_error -x 'no such reposito test_expect_success 'not exported' "test_remote_error -n 'repository not exported' fetch repo.git " stop_git_daemon +start_git_daemon --interpolated-path="$GIT_DAEMON_DOCUMENT_ROOT_PATH/%H%D" + +test_expect_success 'access repo via interpolated hostname' ' + repo="$GIT_DAEMON_DOCUMENT_ROOT_PATH/localhost/interp.git" && + git init --bare "$repo" && + git push "$repo" HEAD && + >"$repo"/git-daemon-export-ok && + rm -rf tmp.git && + GIT_OVERRIDE_VIRTUAL_HOST=localhost \ + git clone --bare "$GIT_DAEMON_URL/interp.git" tmp.git && + rm -rf tmp.git && + GIT_OVERRIDE_VIRTUAL_HOST=LOCALHOST \ + git clone --bare "$GIT_DAEMON_URL/interp.git" tmp.git +' + +test_expect_success 'hostname cannot break out of directory' ' + rm -rf tmp.git && + repo="$GIT_DAEMON_DOCUMENT_ROOT_PATH/../escape.git" && + git init --bare "$repo" && + git push "$repo" HEAD && + >"$repo"/git-daemon-export-ok && + test_must_fail \ + env GIT_OVERRIDE_VIRTUAL_HOST=.. \ + git clone --bare "$GIT_DAEMON_URL/escape.git" tmp.git +' + +stop_git_daemon test_done |