more Improve parameter checks

diff --git a/cgi/git4ai.pl b/cgi/git4ai.pl
index 5dd4f49a50ac779003ab8b9cfb69c6cac176510e..8296c0f143248984dcfba588e59a9ff18eef35c4 100755 (executable)
--- a/cgi/git4ai.pl
+++ b/cgi/git4ai.pl
@@ -5,14 +5,14 @@ use warnings;
 my $BASE_URL = 'https://gitweb.nataraj.world';
 my $LINKS    = 50;
 
-my $repo   = $ENV{GIT_REPO};
-my $branch = $ENV{GIT_BRANCH};
-
-$repo   =~ s{[^a-zA-Z0-9._-]}{}g;
-$branch =~ s{[^a-zA-Z0-9._/\-]}{}g;
-
-die unless $repo;
-die unless $branch;
+my $repo   = $ENV{GIT_REPO}   // '';
+my $branch = $ENV{GIT_BRANCH} // '';
+
+die "Missing GIT_REPO\n"                    unless $repo;
+die "Invalid GIT_REPO: '$repo'\n"           unless $repo   =~ /^[a-zA-Z0-9._-]+$/;
+die "Path traversal in GIT_REPO: '$repo'\n" if     $repo   eq '..';
+die "Missing GIT_BRANCH\n"                  unless $branch;
+die "Invalid GIT_BRANCH: '$branch'\n"       unless $branch =~ m{^[a-zA-Z0-9._/-]+$} || $branch eq '-';
 
 print "Content-Type: text/html; charset=utf-8\r\n";
 print "Cache-Control: no-store, no-cache, must-revalidate\r\n";