From: Nikolay Shaplov <dhyan@nataraj.su>
Date: Sun, 7 Jun 2026 18:31:22 +0000 (+0000)
Subject: more Improve parameter checks
X-Git-Url: http://gitweb.nataraj.world/?a=commitdiff_plain;h=3ea076d160ba699ade008ef1d5d12c19afe46cb1;p=git4ai.git

more Improve parameter checks
---

diff --git a/cgi/git4ai.pl b/cgi/git4ai.pl
index 5dd4f49..8296c0f 100755
--- a/cgi/git4ai.pl
+++ b/cgi/git4ai.pl
@@ -5,14 +5,14 @@ use warnings;
 my $BASE_URL = 'https://gitweb.nataraj.world';
 my $LINKS    = 50;
 
-my $repo   = $ENV{GIT_REPO};
-my $branch = $ENV{GIT_BRANCH};
-
-$repo   =~ s{[^a-zA-Z0-9._-]}{}g;
-$branch =~ s{[^a-zA-Z0-9._/\-]}{}g;
-
-die unless $repo;
-die unless $branch;
+my $repo   = $ENV{GIT_REPO}   // '';
+my $branch = $ENV{GIT_BRANCH} // '';
+
+die "Missing GIT_REPO\n"                    unless $repo;
+die "Invalid GIT_REPO: '$repo'\n"           unless $repo   =~ /^[a-zA-Z0-9._-]+$/;
+die "Path traversal in GIT_REPO: '$repo'\n" if     $repo   eq '..';
+die "Missing GIT_BRANCH\n"                  unless $branch;
+die "Invalid GIT_BRANCH: '$branch'\n"       unless $branch =~ m{^[a-zA-Z0-9._/-]+$} || $branch eq '-';
 
 print "Content-Type: text/html; charset=utf-8\r\n";
 print "Cache-Control: no-store, no-cache, must-revalidate\r\n";