mugit @ 46e2219

···
        35
        35
         	}, nil

      
        36
        36
         }

      
        37
        37
         

      
        
        38
        +var validCommands = map[string]bool{

      
        
        39
        +	"git-upload-pack":    true,

      
        
        40
        +	"git-upload-archive": true,

      
        
        41
        +	"git-receive-pack":   true,

      
        
        42
        +}

      
        
        43
        +

      
        38
        44
         func (s *Shell) HandleCommand(ctx context.Context, cmd string, stdin io.Reader, stdout, stderr io.Writer) error {

      
        39
        45
         	gitCmd, repoName, err := s.parseCommand(cmd)

      
        40
        46
         	if err != nil {

      
        41
        47
         		slog.Error("ssh invalid command", "error", err, "raw_cmd", cmd)

      
        42
        48
         		return err

      
        
        49
        +	}

      
        
        50
        +

      
        
        51
        +	if !validCommands[gitCmd] {

      
        
        52
        +		slog.Error("access denied: invalid git command")

      
        
        53
        +		return fmt.Errorf("access denied: invalid git command")

      
        43
        54
         	}

      
        44
        55
         

      
        45
        56
         	repoPath, err := git.ResolvePath(s.cfg.Repo.Dir, git.ResolveName(repoName))

      

···
        11
        11
         exec cat verify-clone/file.txt

      
        12
        12
         stdout 'hello from ssh'

      
        13
        13
         

      
        
        14
        +

      
        
        15
        +# should not allow execution of commands

      
        
        16
        +! exec $SSH_WRAPPER ignored 'echo hi'

      
        
        17
        +stderr 'access denied:'

      
        
        18
        +

      
        
        19
        +

      
        14
        20
         -- file.txt --

      
        15
        21
         hello from ssh