Skip to content

Commit bde35a2

Browse files
committed
Merge branch 'rs/daemon-sanitize-dir-sep'
"git daemon" has been tightened against systems that take backslash as directory separator. * rs/daemon-sanitize-dir-sep: daemon: sanitize all directory separators
2 parents 1b31224 + 9a7f1ce commit bde35a2

File tree

1 file changed

+4
-4
lines changed

1 file changed

+4
-4
lines changed

daemon.c

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -566,14 +566,14 @@ static void parse_host_and_port(char *hostport, char **host,
566566

567567
/*
568568
* Sanitize a string from the client so that it's OK to be inserted into a
569-
* filesystem path. Specifically, we disallow slashes, runs of "..", and
570-
* trailing and leading dots, which means that the client cannot escape
571-
* our base path via ".." traversal.
569+
* filesystem path. Specifically, we disallow directory separators, runs
570+
* of "..", and trailing and leading dots, which means that the client
571+
* cannot escape our base path via ".." traversal.
572572
*/
573573
static void sanitize_client(struct strbuf *out, const char *in)
574574
{
575575
for (; *in; in++) {
576-
if (*in == '/')
576+
if (is_dir_sep(*in))
577577
continue;
578578
if (*in == '.' && (!out->len || out->buf[out->len - 1] == '.'))
579579
continue;

0 commit comments

Comments
 (0)