Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commit64ebb9f

Browse files
committed
This change adds a check during reference resolving to see if itcontains an up-level reference ('..'). If it does, it raises anexception.This fixesCVE-2023-41040, which allows an attacker to access filesoutside the repository's directory.
1 parent91b464c commit64ebb9f

File tree

1 file changed

+2
-0
lines changed

1 file changed

+2
-0
lines changed

‎git/refs/symbolic.py

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -168,6 +168,8 @@ def _get_ref_info_helper(
168168
"""Return: (str(sha), str(target_ref_path)) if available, the sha the file at
169169
rela_path points to, or None. target_ref_path is the reference we
170170
point to, or None"""
171+
if".."instr(ref_path):
172+
raiseValueError(f"Invalid reference '{ref_path}'")
171173
tokens:Union[None,List[str],Tuple[str,str]]=None
172174
repodir=_git_dir(repo,ref_path)
173175
try:

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp