mirrors/git
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Verify Content-Type from smart HTTP servers

Browse Source 
Before parsing a suspected smart-HTTP response verify the returned
Content-Type matches the standard. This protects a client from
attempting to process a payload that smells like a smart-HTTP
server response.

JGit has been doing this check on all responses since the dawn of
time. I mistakenly failed to include it in git-core when smart HTTP
was introduced. At the time I didn't know how to get the Content-Type
from libcurl. I punted, meant to circle back and fix this, and just
plain forgot about it.

Signed-off-by: Shawn Pearce <spearce@spearce.org>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
This commit is contained in:
Shawn Pearce
2013-01-31 13:02:07 -08:00
committed by Junio C Hamano
parent e1b6ff44d6
commit 4656bf47fc
8 changed files with 59 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
t/lib-httpd/apache.conf
View File

@ -62,9 +62,13 @@ Alias /auth/dumb/ www/auth/dumb/
SetEnv GIT_COMMITTER_EMAIL custom@example.com
</LocationMatch>
ScriptAliasMatch /smart_*[^/]*/(.*) ${GIT_EXEC_PATH}/git-http-backend/$1
ScriptAlias /broken_smart/ broken-smart-http.sh/
<Directory ${GIT_EXEC_PATH}>
Options FollowSymlinks
</Directory>
<Files broken-smart-http.sh>
Options ExecCGI
</Files>
<Files ${GIT_EXEC_PATH}/git-http-backend>
Options ExecCGI
</Files>

11
t/lib-httpd/broken-smart-http.sh Executable file
View File

@ -0,0 +1,11 @@
#!/bin/sh
printf "Content-Type: text/%s\n" "html"
echo
printf "%s\n" "001e# service=git-upload-pack"
printf "%s" "0000"
printf "%s%c%s%s\n" \
"00a58681d9f286a48b08f37b3a095330da16689e3693 HEAD" \
0 \
" include-tag multi_ack_detailed multi_ack ofs-delta" \
" side-band side-band-64k thin-pack no-progress shallow no-done "
printf "%s" "0000"