From e40f3557f7e767bd2be2a824bc3bc2379aa69931 Mon Sep 17 00:00:00 2001 From: Michael Haggerty Date: Wed, 27 Apr 2016 12:40:39 +0200 Subject: refname_is_safe(): insist that the refname already be normalized The reference name is going to be compared to other reference names, so it should be in its normalized form. Signed-off-by: Michael Haggerty --- refs.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) (limited to 'refs.c') diff --git a/refs.c b/refs.c index ca0280f7eb..b18d9959af 100644 --- a/refs.c +++ b/refs.c @@ -125,14 +125,19 @@ int refname_is_safe(const char *refname) if (skip_prefix(refname, "refs/", &rest)) { char *buf; int result; + size_t restlen = strlen(rest); + + /* rest must not be empty, or start or end with "/" */ + if (!restlen || *rest == '/' || rest[restlen - 1] == '/') + return 0; /* * Does the refname try to escape refs/? * For example: refs/foo/../bar is safe but refs/foo/../../bar * is not. */ - buf = xmallocz(strlen(rest)); - result = !normalize_path_copy(buf, rest); + buf = xmallocz(restlen); + result = !normalize_path_copy(buf, rest) && !strcmp(buf, rest); free(buf); return result; } -- cgit v1.2.1