Expand description
Path-traversal guard — mirrors JSS src/handlers/git.js lines
31-62 (extractRepoPath + isPathWithinDataRoot).
JSS iteratively strips .. segments (multi-pass, to defeat
....// bypass) and then asserts the resolved absolute path still
starts with the data-root prefix. We do the same, plus an explicit
rejection of absolute paths and of any remaining .. component
after canonicalisation.
Functions§
- extract_
repo_ slug - Strip the Git service suffixes (
/info/refs,/git-upload-pack,/git-receive-pack) from the incoming URL path to recover the repository-relative slug. - path_
safe - Resolve
requestedagainstrepo_rootand assert the result stays inside the root. Rejects: