summaryrefslogtreecommitdiffstatshomepage
path: root/cache.h
diff options
context:
space:
mode:
authorJason A. Donenfeld2013-05-25 19:47:15 +0200
committerJason A. Donenfeld2013-05-25 20:33:28 +0200
commitfe36f84d843cd755c6dab629a0758264de5bcc00 (patch)
treefee8af2ed0f3df2fa9015453ce3e8d721df6a0cd /cache.h
parent2a1ead3efb940b7359bcc706c19bd8ddb0de7a11 (diff)
downloadcgit-fe36f84d843cd755c6dab629a0758264de5bcc00.tar
cgit-fe36f84d843cd755c6dab629a0758264de5bcc00.tar.gz
cgit-fe36f84d843cd755c6dab629a0758264de5bcc00.zip
ui-summary: Disallow directory traversal
Using the url= query string, it was possible request arbitrary files from the filesystem if the readme for a given page was set to a filesystem file. The following request would return my /etc/passwd file: http://git.zx2c4.com/?url=/somerepo/about/../../../../etc/passwd http://data.zx2c4.com/cgit-directory-traversal.png This fix uses realpath(3) to canonicalize all paths, and then compares the base components. This fix introduces a subtle timing attack, whereby a client can check whether or not strstr is called using timing measurements in order to determine if a given file exists on the filesystem. This fix also does not account for filesystem race conditions (TOCTOU) in resolving symlinks. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
Diffstat (limited to 'cache.h')
0 files changed, 0 insertions, 0 deletions
n */ .highlight .kn { color: #008800; font-weight: bold } /* Keyword.Namespace */ .highlight .kp { color: #008800 } /* Keyword.Pseudo */ .highlight .kr { color: #008800; font-weight: bold } /* Keyword.Reserved */ .highlight .kt { color: #888888; font-weight: bold } /* Keyword.Type */ .highlight .m { color: #0000DD; font-weight: bold } /* Literal.Number */ .highlight .s { color: #dd2200; background-color: #fff0f0 } /* Literal.String */ .highlight .na { color: #336699 } /* Name.Attribute */ .highlight .nb { color: #003388 } /* Name.Builtin */ .highlight .nc { color: #bb0066; font-weight: bold } /* Name.Class */ .highlight .no { color: #003366; font-weight: bold } /* Name.Constant */ .highlight .nd { color: #555555 } /* Name.Decorator */ .highlight .ne { color: #bb0066; font-weight: bold } /* Name.Exception */ .highlight .nf { color: #0066bb; font-weight: bold } /* Name.Function */ .highlight .nl { color: #336699; font-style: italic } /* Name.Label */ .highlight .nn { color: #bb0066; font-weight: bold } /* Name.Namespace */ .highlight .py { color: #336699; font-weight: bold } /* Name.Property */ .highlight .nt { color: #bb0066; font-weight: bold } /* Name.Tag */ .highlight .nv { color: #336699 } /* Name.Variable */ .highlight .ow { color: #008800 } /* Operator.Word */ .highlight .w { color: #bbbbbb } /* Text.Whitespace */ .highlight .mb { color: #0000DD; font-weight: bold } /* Literal.Number.Bin */ .highlight .mf { color: #0000DD; font-weight: bold } /* Literal.Number.Float */ .highlight .mh { color: #0000DD; font-weight: bold } /* Literal.Number.Hex */ .highlight .mi { color: #0000DD; font-weight: bold } /* Literal.Number.Integer */ .highlight .mo { color: #0000DD; font-weight: bold } /* Literal.Number.Oct */ .highlight .sa { color: #dd2200; background-color: #fff0f0 } /* Literal.String.Affix */ .highlight .sb { color: #dd2200; background-color: #fff0f0 } /* Literal.String.Backtick */ .highlight .sc { color: #dd2200; background-color: #fff0f0 } /* Literal.String.Char */ .highlight .dl { color: #dd2200; background-color: #fff0f0 } /* Literal.String.Delimiter */ .highlight .sd { color: #dd2200; background-color: #fff0f0 } /* Literal.String.Doc */ .highlight .s2 { color: #dd2200; background-color: #fff0f0 } /* Literal.String.Double */ .highlight .se { color: #0044dd; background-color: #fff0f0 } /* Literal.String.Escape */ .highlight .sh { color: #dd2200; background-color: #fff0f0 } /* Literal.String.Heredoc */ .highlight .si { color: #3333bb; background-color: #fff0f0 } /* Literal.String.Interpol */ .highlight .sx { color: #22bb22; background-color: #f0fff0 } /* Literal.String.Other */ .highlight .sr { color: #008800; background-color: #fff0ff } /* Literal.String.Regex */ .highlight .s1 { color: #dd2200; background-color: #fff0f0 } /* Literal.String.Single */ .highlight .ss { color: #aa6600; background-color: #fff0f0 } /* Literal.String.Symbol */ .highlight .bp { color: #003388 } /* Name.Builtin.Pseudo */ .highlight .fm { color: #0066bb; font-weight: bold } /* Name.Function.Magic */ .highlight .vc { color: #336699 } /* Name.Variable.Class */ .highlight .vg { color: #dd7700 } /* Name.Variable.Global */ .highlight .vi { color: #3333bb } /* Name.Variable.Instance */ .highlight .vm { color: #336699 } /* Name.Variable.Magic */ .highlight .il { color: #0000DD; font-weight: bold } /* Literal.Number.Integer.Long */
#ifndef UI_SHARED_H
#define UI_SHARED_H

extern const char *cgit_httpscheme(void);
extern char *cgit_hosturl(void);
extern const char *cgit_rooturl(void);
extern char *cgit_currenturl(void);
extern const char *cgit_loginurl(void);
extern char *cgit_repourl(const char *reponame);
extern char *cgit_fileurl(const char *reponame, const char *pagename,
			  const char *filename, const char *query);
extern char *cgit_pageurl(const char *reponame, const char *pagename,
			  const char *query);

extern void cgit_add_clone_urls(void (*fn)(const char *));

extern void cgit_index_link(const char *name, const char *title,
			    const char *class, const char *pattern, const char *sort, int ofs, int always_root);
extern void cgit_summary_link(const char *name, const char *title,
			      const char *class, const char *head);
extern void cgit_tag_link(const char *name, const char *title,
			  const char *class, const char *tag);
extern void cgit_tree_link(const char *name, const char *title,
			   const char *class, const char *head,
			   const char *rev, const char *path);
extern void cgit_plain_link(const char *name, const char *title,
			    const char *class, const char *head,
			    const char *rev, const char *path);
extern void cgit_log_link(const char *name, const char *title,
			  const char *class, const char *head, const char *rev,
			  const char *path, int ofs, const char *grep,
			  const char *pattern, int showmsg, int follow);
extern void cgit_commit_link(char *name, const char *title,
			     const char *class, const char *head,
			     const char *rev, const char *path);
extern void cgit_patch_link(const char *name, const char *title,
			    const char *class, const char *head,
			    const char *rev, const char *path);
extern void cgit_refs_link(const char *name, const char *title,
			   const char *class, const char *head,
			   const char *rev, const char *path);
extern void cgit_snapshot_link(const char *name, const char *title,
			       const char *class, const char *head,
			       const char *rev, const char *archivename);
extern void cgit_diff_link(const char *name, const char *title,
			   const char *class, const char *head,
			   const char *new_rev, const char *old_rev,
			   const char *path);
extern void cgit_stats_link(const char *name, const char *title,
			    const char *class, const char *head,
			    const char *path);
extern void cgit_object_link(struct object *obj);

extern void cgit_submodule_link(const char *class, char *path,
				const char *rev);

extern void cgit_print_layout_start(void);
extern void cgit_print_layout_end(void);

__attribute__((format (printf,1,2)))
extern void cgit_print_error(const char *fmt, ...);
__attribute__((format (printf,1,0)))
extern void cgit_vprint_error(const char *fmt, va_list ap);
extern const struct date_mode *cgit_date_mode(enum date_mode_type type);
extern void cgit_print_age(time_t t, int tz, time_t max_relative);
extern void cgit_print_http_headers(void);
extern void cgit_redirect(const char *url, bool permanent);
extern void cgit_print_docstart(void);
extern void cgit_print_docend(void);
__attribute__((format (printf,3,4)))
extern void cgit_print_error_page(int code, const char *msg, const char *fmt, ...);
extern void cgit_print_pageheader(void);
extern void cgit_print_filemode(unsigned short mode);
extern void cgit_print_snapshot_links(const char *repo, const char *head,
				      const char *hex, int snapshots);
extern void cgit_add_hidden_formfields(int incl_head, int incl_search,
				       const char *page);
#endif /* UI_SHARED_H */