Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly
Appearance settings

Commit 64ebb9f

Browse filesBrowse files
facutuescafacutuesca
committed
This change adds a check during reference resolving to see if it contains an up-level reference ('..'). If it does, it raises an exception. This fixes CVE-2023-41040, which allows an attacker to access files outside the repository's directory.
1 parent 91b464c commit 64ebb9f
Copy full SHA for 64ebb9f

File tree

1 file changed

+2
-0
lines changed
Filter options

1 file changed

+2
-0
lines changed

‎git/refs/symbolic.py

Copy file name to clipboardExpand all lines: git/refs/symbolic.py
+2Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -168,6 +168,8 @@ def _get_ref_info_helper(
168168
"""Return: (str(sha), str(target_ref_path)) if available, the sha the file at
169169
rela_path points to, or None. target_ref_path is the reference we
170170
point to, or None"""
171+
if ".." in str(ref_path):
172+
raise ValueError(f"Invalid reference '{ref_path}'")
171173
tokens: Union[None, List[str], Tuple[str, str]] = None
172174
repodir = _git_dir(repo, ref_path)
173175
try:

0 commit comments

Comments
0 (0)
Morty Proxy This is a proxified and sanitized view of the page, visit original site.