Commit ae7ffea9 by nulltoken Committed by Vicent Marti

Fixed a parsing issue in git_prettify_dir_path().

parent b29e8f19
...@@ -394,8 +394,9 @@ static int retrieve_previous_path_component_start(const char *path) ...@@ -394,8 +394,9 @@ static int retrieve_previous_path_component_start(const char *path)
int git_prettify_dir_path(char *buffer_out, const char *path) int git_prettify_dir_path(char *buffer_out, const char *path)
{ {
int len = 0; int len = 0;
char *current; char *current, *end;
const char *buffer_out_start, *buffer_end; const char *buffer_out_start, *buffer_end;
int only_dots;
buffer_out_start = buffer_out; buffer_out_start = buffer_out;
current = (char *)path; current = (char *)path;
...@@ -408,40 +409,52 @@ int git_prettify_dir_path(char *buffer_out, const char *path) ...@@ -408,40 +409,52 @@ int git_prettify_dir_path(char *buffer_out, const char *path)
continue; continue;
} }
/* Skip current directory */ end = current;
if (*current == '.') { only_dots = 1;
current++;
/* Seek end of path segment */
/* Handle the double-dot upward directory navigation */ while (end < buffer_end && *end !='/')
if (current < buffer_end && *current == '.') { {
current++; only_dots &= (*end == '.');
end++;
/* Guard against potential multiple dot path traversal (cf http://cwe.mitre.org/data/definitions/33.html) */ }
if (*current == '.')
return GIT_ERROR;
*buffer_out ='\0'; /* Skip current directory */
len = retrieve_previous_path_component_start(buffer_out_start); if (only_dots && end == current + 1)
if (len < GIT_SUCCESS) {
return GIT_ERROR; current += 2;
continue;
}
buffer_out = (char *)buffer_out_start + len; /* Handle the double-dot upward directory navigation */
} if (only_dots && end == current + 2)
{
*buffer_out ='\0';
len = retrieve_previous_path_component_start(buffer_out_start);
if (len < GIT_SUCCESS)
return GIT_ERROR;
buffer_out = (char *)buffer_out_start + len;
current += 3;
continue;
}
if (current < buffer_end && *current == '/') /* Guard against potential multiple dot path traversal (cf http://cwe.mitre.org/data/definitions/33.html) */
current++; if (only_dots && end > current)
return GIT_ERROR;
continue; /* Copy to output the path segment */
while (current < end)
{
*buffer_out++ = *current++;
len++;
} }
*buffer_out++ = *current++; *buffer_out++ = '/';
len++; len++;
} }
/* Add a trailing slash if required */
if (len > 0 && buffer_out_start[len-1] != '/')
*buffer_out++ = '/';
*buffer_out = '\0'; *buffer_out = '\0';
return GIT_SUCCESS; return GIT_SUCCESS;
......
...@@ -20,6 +20,10 @@ static int ensure_normalized(const char *input_path, const char *expected_path) ...@@ -20,6 +20,10 @@ static int ensure_normalized(const char *input_path, const char *expected_path)
} }
BEGIN_TEST(path_prettifying) BEGIN_TEST(path_prettifying)
must_pass(ensure_normalized("./testrepo.git", "testrepo.git/"));
must_pass(ensure_normalized("./.git", ".git/"));
must_pass(ensure_normalized("./git.", "git./"));
must_pass(ensure_normalized("git./", "git./"));
must_pass(ensure_normalized("", "")); must_pass(ensure_normalized("", ""));
must_pass(ensure_normalized(".", "")); must_pass(ensure_normalized(".", ""));
must_pass(ensure_normalized("./", "")); must_pass(ensure_normalized("./", ""));
...@@ -53,7 +57,11 @@ BEGIN_TEST(path_prettifying) ...@@ -53,7 +57,11 @@ BEGIN_TEST(path_prettifying)
must_fail(ensure_normalized("d1/...", NULL)); must_fail(ensure_normalized("d1/...", NULL));
must_fail(ensure_normalized("d1/.../", NULL)); must_fail(ensure_normalized("d1/.../", NULL));
must_fail(ensure_normalized("d1/.../d2", NULL)); must_fail(ensure_normalized("d1/.../d2", NULL));
must_pass(ensure_normalized("/./testrepo.git", "/testrepo.git/"));
must_pass(ensure_normalized("/./.git", "/.git/"));
must_pass(ensure_normalized("/./git.", "/git./"));
must_pass(ensure_normalized("/git./", "/git./"));
must_pass(ensure_normalized("/", "/")); must_pass(ensure_normalized("/", "/"));
must_pass(ensure_normalized("//", "/")); must_pass(ensure_normalized("//", "/"));
must_pass(ensure_normalized("///", "/")); must_pass(ensure_normalized("///", "/"));
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment