Jason A. Donenfeld 53efaf30b5 clone: fix directory traversal ...

This was introduced in the initial version of this code, way back when
in 2008.

$ curl http://127.0.0.1/cgit/repo/objects/?path=../../../../../../../../../etc/passwd
root:x:0:0:root:/root:/bin/sh
...

Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
Reported-by: Jann Horn <jannh@google.com>

2018-08-03 17:04:03 +02:00

2.8 KiB

Raw Blame History

View Raw