From: Nikolay Shaplov <dhyan@nataraj.su>
Date: Sun, 7 Jun 2026 18:25:08 +0000 (+0000)
Subject: Improve parameter checks
X-Git-Url: http://gitweb.nataraj.world/?a=commitdiff_plain;h=3f35fe959c816d1c57ebbf9b6d6dadd79359ac87;p=git4ai.git

Improve parameter checks
---

diff --git a/cgi/git4ai-branches.pl b/cgi/git4ai-branches.pl
index c81f4d3..c4de464 100755
--- a/cgi/git4ai-branches.pl
+++ b/cgi/git4ai-branches.pl
@@ -5,11 +5,11 @@ use warnings;
 my $GIT_ROOT = '/var/lib/git';
 my $BASE_URL = 'https://gitweb.nataraj.world';
 
-my $repo = $ENV{GIT_REPO};
+my $repo = $ENV{GIT_REPO} // '';
 
-$repo =~ s{[^a-zA-Z0-9._-]}{}g;
-
-die unless $repo;
+die "Missing GIT_REPO\n"                    unless $repo;
+die "Invalid GIT_REPO: '$repo'\n"           unless $repo =~ /^[a-zA-Z0-9._-]+$/;
+die "Path traversal in GIT_REPO: '$repo'\n" if     $repo eq '..';
 
 my $git_dir = "$GIT_ROOT/$repo";
 
diff --git a/cgi/git4ai-cat-file.pl b/cgi/git4ai-cat-file.pl
index 6781098..b737c90 100755
--- a/cgi/git4ai-cat-file.pl
+++ b/cgi/git4ai-cat-file.pl
@@ -4,14 +4,14 @@ use warnings;
 
 my $GIT_ROOT = '/var/lib/git';
 
-my $repo    = $ENV{GIT_REPO};
-my $blob_id = $ENV{GIT_ID} || $ENV{GIT_BLOB_ID};
-
-$repo    =~ s{[^a-zA-Z0-9._-]}{}g;
-$blob_id =~ s{[^0-9a-f]}{}g;
-
-die unless $repo;
-die unless $blob_id;
+my $repo    = $ENV{GIT_REPO}                      // '';
+my $blob_id = ($ENV{GIT_ID} || $ENV{GIT_BLOB_ID}) // '';
+
+die "Missing GIT_REPO\n"                    unless $repo;
+die "Invalid GIT_REPO: '$repo'\n"           unless $repo    =~ /^[a-zA-Z0-9._-]+$/;
+die "Path traversal in GIT_REPO: '$repo'\n" if     $repo    eq '..';
+die "Missing blob id\n"                     unless $blob_id;
+die "Invalid blob id: '$blob_id'\n"         unless $blob_id =~ /^[0-9a-f]{4,40}$/;
 
 open(my $fh, '-|', 'git', "--git-dir=$GIT_ROOT/$repo",
     'cat-file', 'blob', $blob_id)
diff --git a/cgi/git4ai-log.pl b/cgi/git4ai-log.pl
index 812d3ed..ad38aac 100755
--- a/cgi/git4ai-log.pl
+++ b/cgi/git4ai-log.pl
@@ -6,20 +6,21 @@ my $GIT_ROOT = '/var/lib/git';
 my $PER_PAGE = 20;
 my $BASE_URL = 'https://gitweb.nataraj.world';
 
-my $repo   = $ENV{GIT_REPO};
-my $branch = $ENV{GIT_BRANCH} // 'master';
-my $offset = int($ENV{GIT_OFFSET} // 0);
-my $nonce = $ENV{GIT_NONCE} || $ENV{REQUEST_ID};
+my $repo   = $ENV{GIT_REPO}   // '';
+my $branch = $ENV{GIT_BRANCH} // '';
+my $offset = $ENV{GIT_OFFSET} // '0';
+my $nonce  = ($ENV{GIT_NONCE} || $ENV{REQUEST_ID}) // '';
 
+die "Missing GIT_REPO\n"                    unless $repo;
+die "Invalid GIT_REPO: '$repo'\n"           unless $repo   =~ /^[a-zA-Z0-9._-]+$/;
+die "Path traversal in GIT_REPO: '$repo'\n" if     $repo   eq '..';
+die "Missing GIT_BRANCH\n"                  unless $branch;
+die "Invalid GIT_BRANCH: '$branch'\n"       unless $branch =~ m{^[a-zA-Z0-9._/-]+$} || $branch eq '-';
+die "Invalid GIT_OFFSET: '$offset'\n"       unless $offset =~ /^[0-9]+$/;
 
-$repo   =~ s{[^a-zA-Z0-9._-]}{}g;
-$branch =~ s{[^a-zA-Z0-9._/\-]}{}g; 
-$offset = 0 if $offset < 0;
+$offset = int($offset);
 $nonce  =~ s{[^a-zA-Z0-9._-]}{}g;
 
-die unless $repo;
-die unless $branch;
-
 my $rand    = int(rand(1_000_000_000));
 my $git_dir = "$GIT_ROOT/$repo";
 
diff --git a/cgi/git4ai-ls-tree.pl b/cgi/git4ai-ls-tree.pl
index 06ba1f6..7808f6b 100755
--- a/cgi/git4ai-ls-tree.pl
+++ b/cgi/git4ai-ls-tree.pl
@@ -6,16 +6,18 @@ my $GIT_ROOT = '/var/lib/git';
 my $PER_PAGE = 50;
 my $BASE_URL = 'https://gitweb.nataraj.world';
 
-my $repo   = $ENV{GIT_REPO};
-my $commit_id  = $ENV{GIT_ID} || $ENV{GIT_COMMIT_ID};
-my $offset = int($ENV{GIT_OFFSET} // 0);
-
-$repo =~ s{[^a-zA-Z0-9._-]}{}g;
-$commit_id  =~ s{[^0-9a-f]}{}g;
-$offset = 0 if $offset < 0;
-
-die unless $repo;
-die unless $commit_id;
+my $repo      = $ENV{GIT_REPO}                        // '';
+my $commit_id = ($ENV{GIT_ID} || $ENV{GIT_COMMIT_ID}) // '';
+my $offset    = $ENV{GIT_OFFSET}                       // '0';
+
+die "Missing GIT_REPO\n"                      unless $repo;
+die "Invalid GIT_REPO: '$repo'\n"             unless $repo      =~ /^[a-zA-Z0-9._-]+$/;
+die "Path traversal in GIT_REPO: '$repo'\n"   if     $repo      eq '..';
+die "Missing commit id\n"                     unless $commit_id;
+die "Invalid commit id: '$commit_id'\n"       unless $commit_id =~ /^[0-9a-f]{4,40}$/;
+die "Invalid GIT_OFFSET: '$offset'\n"         unless $offset    =~ /^[0-9]+$/;
+
+$offset = int($offset);
 
 my $rand    = int(rand(1_000_000_000));
 my $git_dir = "$GIT_ROOT/$repo";
diff --git a/cgi/git4ai-show.pl b/cgi/git4ai-show.pl
index 0f9eb91..5549337 100755
--- a/cgi/git4ai-show.pl
+++ b/cgi/git4ai-show.pl
@@ -4,14 +4,14 @@ use warnings;
 
 my $GIT_ROOT = '/var/lib/git';
 
-my $repo   = $ENV{GIT_REPO};
-my $commit = $ENV{GIT_ID} || $ENV{GIT_COMMIT};
+my $repo   = $ENV{GIT_REPO} // '';
+my $commit = ($ENV{GIT_ID} || $ENV{GIT_COMMIT}) // '';
 
-$repo   =~ s{[^a-zA-Z0-9._-]}{}g;
-$commit =~ s{[^0-9a-f]}{}g;
-
-die unless $repo;
-die unless $commit;
+die "Missing GIT_REPO\n"                    unless $repo;
+die "Invalid GIT_REPO: '$repo'\n"           unless $repo   =~ /^[a-zA-Z0-9._-]+$/;
+die "Path traversal in GIT_REPO: '$repo'\n" if     $repo   eq '..';
+die "Missing commit id\n"                   unless $commit;
+die "Invalid commit id: '$commit'\n"        unless $commit =~ /^[0-9a-f]{4,40}$/;
 
 print "Content-Type: text/plain; charset=utf-8\r\n";
 print "Cache-Control: no-store, no-cache, must-revalidate\r\n";