gitweb: add $prevent_xss option to prevent XSS by repository content
Add a gitweb configuration variable $prevent_xss that disables features to prevent content in repositories from launching cross-site scripting (XSS) attacks in the gitweb domain. Currently, this option makes gitweb ignore README.html (a better solution may be worked out in the future) and serve a blob_plain file of an untrusted type with "Content-Disposition: attachment", which tells the browser not to show the file at its original URL. The XSS prevention is currently off by default. Signed-off-by: Matt McCutchen <matt@mattmccutchen.net> Signed-off-by: Junio C Hamano <gitster@pobox.com>
Matt McCutchen committed
Feb 7, 2009 at 19:00 UTC
7e1100e9e939c9178b2aa3969349e9e8d34488bf
2 files changed
+27
-3
gitweb/README
+8
-1
@@ -214,6 +214,11 @@ not include variables usually directly set during build):
214
Rename detection options for git-diff and git-diff-tree. By default
215
('-M'); set it to ('-C') or ('-C', '-C') to also detect copies, or
216
set it to () if you don't want to have renames detection.
217
+ * $prevent_xss
218
+ If true, some gitweb features are disabled to prevent content in
219
+ repositories from launching cross-site scripting (XSS) attacks. Set this
220
+ to true if you don't trust the content of your repositories. The default
221
+ is false.
222
223
224
Projects list file format
@@ -260,7 +265,9 @@ You can use the following files in repository:
265
A .html file (HTML fragment) which is included on the gitweb project
266
summary page inside <div> block element. You can use it for longer
267
description of a project, to provide links (for example to project's
263
- homepage), etc.
268
+ homepage), etc. This is recognized only if XSS prevention is off
269
+ ($prevent_xss is false); a way to include a readme safely when XSS
270
+ prevention is on may be worked out in the future.
271
* description (or gitweb.description)
272
Short (shortened by default to 25 characters in the projects list page)
273
single line description of a project (of a repository). Plain text file;
gitweb/gitweb.perl
+19
-2
@@ -132,6 +132,10 @@ our $fallback_encoding = 'latin1';
132
# - one might want to include '-B' option, e.g. '-B', '-M'
133
our @diff_opts = ('-M'); # taken from git_commit
134
135
+# Disables features that would allow repository owners to inject script into
136
+# the gitweb domain.
137
+our $prevent_xss = 0;
138
+
139
# information about snapshot formats that gitweb is capable of serving
140
our %known_snapshot_formats = (
141
# name => {
@@ -4494,7 +4498,9 @@ sub git_summary {
4498
4499
print "</table>\n";
4500
4497
- if (-s "$projectroot/$project/README.html") {
4501
+ # If XSS prevention is on, we don't include README.html.
4502
+ # TODO: Allow a readme in some safe format.
4503
+ if (!$prevent_xss && -s "$projectroot/$project/README.html") {
4504
print "<div class=\"title\">readme</div>\n" .
4505
"<div class=\"readme\">\n";
4506
insert_file("$projectroot/$project/README.html");
@@ -4739,10 +4745,21 @@ sub git_blob_plain {
4745
$save_as .= '.txt';
4746
}
4747
4748
+ # With XSS prevention on, blobs of all types except a few known safe
4749
+ # ones are served with "Content-Disposition: attachment" to make sure
4750
+ # they don't run in our security domain. For certain image types,
4751
+ # blob view writes an <img> tag referring to blob_plain view, and we
4752
+ # want to be sure not to break that by serving the image as an
4753
+ # attachment (though Firefox 3 doesn't seem to care).
4754
+ my $sandbox = $prevent_xss &&
4755
+ $type !~ m!^(?:text/plain|image/(?:gif|png|jpeg))$!;
4756
+
4757
print $cgi->header(
4758
-type => $type,
4759
-expires => $expires,
4745
- -content_disposition => 'inline; filename="' . $save_as . '"');
4760
+ -content_disposition =>
4761
+ ($sandbox ? 'attachment' : 'inline')
4762
+ . '; filename="' . $save_as . '"');
4763
undef $/;
4764
binmode STDOUT, ':raw';
4765
print <$fd>;