refname_is_safe(): insist that the refname already be normalized
The reference name is going to be compared to other reference names, so it should be in its normalized form. Signed-off-by: Michael Haggerty <mhagger@alum.mit.edu>
Michael Haggerty committed
Apr 27, 2016 at 12:40 UTC
e40f3557f7e767bd2be2a824bc3bc2379aa69931
1 file changed
+7
-2
refs.c
+7
-2
@@ -125,14 +125,19 @@ int refname_is_safe(const char *refname)
125
if (skip_prefix(refname, "refs/", &rest)) {
126
char *buf;
127
int result;
128
+ size_t restlen = strlen(rest);
129
+
130
+ /* rest must not be empty, or start or end with "/" */
131
+ if (!restlen || *rest == '/' || rest[restlen - 1] == '/')
132
+ return 0;
133
134
/*
135
* Does the refname try to escape refs/?
136
* For example: refs/foo/../bar is safe but refs/foo/../../bar
137
* is not.
138
*/
134
- buf = xmallocz(strlen(rest));
135
- result = !normalize_path_copy(buf, rest);
139
+ buf = xmallocz(restlen);
140
+ result = !normalize_path_copy(buf, rest) && !strcmp(buf, rest);
141
free(buf);
142
return result;
143
}