From 3ea076d160ba699ade008ef1d5d12c19afe46cb1 Mon Sep 17 00:00:00 2001 From: Nikolay Shaplov Date: Sun, 7 Jun 2026 18:31:22 +0000 Subject: [PATCH] more Improve parameter checks --- cgi/git4ai.pl | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/cgi/git4ai.pl b/cgi/git4ai.pl index 5dd4f49..8296c0f 100755 --- a/cgi/git4ai.pl +++ b/cgi/git4ai.pl @@ -5,14 +5,14 @@ use warnings; my $BASE_URL = 'https://gitweb.nataraj.world'; my $LINKS = 50; -my $repo = $ENV{GIT_REPO}; -my $branch = $ENV{GIT_BRANCH}; - -$repo =~ s{[^a-zA-Z0-9._-]}{}g; -$branch =~ s{[^a-zA-Z0-9._/\-]}{}g; - -die unless $repo; -die unless $branch; +my $repo = $ENV{GIT_REPO} // ''; +my $branch = $ENV{GIT_BRANCH} // ''; + +die "Missing GIT_REPO\n" unless $repo; +die "Invalid GIT_REPO: '$repo'\n" unless $repo =~ /^[a-zA-Z0-9._-]+$/; +die "Path traversal in GIT_REPO: '$repo'\n" if $repo eq '..'; +die "Missing GIT_BRANCH\n" unless $branch; +die "Invalid GIT_BRANCH: '$branch'\n" unless $branch =~ m{^[a-zA-Z0-9._/-]+$} || $branch eq '-'; print "Content-Type: text/html; charset=utf-8\r\n"; print "Cache-Control: no-store, no-cache, must-revalidate\r\n"; -- 2.47.3