| commit | 39efae1455a694075278931c17fba742d8b7d6d7 | |
| author | Shawn O. Pearce <spearce@spearce.org> | |
| Mon, 9 Feb 2009 15:23:37 +0000 (9 07:23 -0800) | ||
| committer | Robin Rosenberg <robin.rosenberg@dewire.com> | |
| Mon, 9 Feb 2009 21:19:42 +0000 (9 22:19 +0100) | ||
| tree | b7c9e7397ec48b770087f63e8547d0be0eb875d1 | treesnapshot (tar.gz zip) |
| parent | 8df7fedc2eb3924d5fd6e2033dda4b3c37213c70 | commitdiff |
Permit a wider range of repository names in jgit daemon requests
The earlier restriction was too narrow for some applications, for
example repositories named "jgit.dev" and "jgit.test" are perfectly
valid Git repositories and should still be able to be served by
the daemon.
By blocking out only uses of ".." as a path component and Windows
UNC paths (by blocking "//") we can reasonably prevent the client
from escaping the base directories configured in the daemon.
Signed-off-by: Shawn O. Pearce <spearce@spearce.org>
Signed-off-by: Robin Rosenberg <robin.rosenberg@dewire.com>
The earlier restriction was too narrow for some applications, for
example repositories named "jgit.dev" and "jgit.test" are perfectly
valid Git repositories and should still be able to be served by
the daemon.
By blocking out only uses of ".." as a path component and Windows
UNC paths (by blocking "//") we can reasonably prevent the client
from escaping the base directories configured in the daemon.
Signed-off-by: Shawn O. Pearce <spearce@spearce.org>
Signed-off-by: Robin Rosenberg <robin.rosenberg@dewire.com>
| org.spearce.jgit/src/org/spearce/jgit/transport/Daemon.java | diffblobblamehistory |