Escape repository path

Signed-off-by: Dmitriy Zaporozhets <dmitriy.zaporozhets@gmail.com>

1 files changed, 9 insertions, 1 deletions

diff --git a/lib/gitlab_shell.rb b/lib/gitlab_shell.rb
index c73bc29..65f7786 100644
--- a/lib/gitlab_shell.rb
+++ b/lib/gitlab_shell.rb
@@ -43,7 +43,7 @@ class GitlabShell
   def parse_cmd
     args = Shellwords.shellwords(@origin_cmd)
     @git_cmd = args[0]
-    @repo_name = args[1]
+    @repo_name = escape_path(args[1])
   end
 
   def git_cmds
@@ -86,4 +86,12 @@ class GitlabShell
   def log_username
     @config.audit_usernames ? username : "user with key #{@key_id}"
   end
+
+  def escape_path(path)
+    if File.absolute_path(path, repos_path) == File.join(repos_path, path)
+      path
+    else
+      raise "Wrong repository path"
+    end
+  end
 end