2 files changed,
8 insertions(+),
2 deletions(-)
Author:
Oleksandr Smirnov
olexsmir@gmail.com
Committed at:
2026-06-25 21:31:37 +0300
Authored at:
2026-06-25 21:06:00 +0300
Change ID:
zwspnswzsmzuxomomlrpystltsrlyzvt
Parent:
b8831a7
jump to
| M | internal/git/archive.go |
| M | internal/git/archive_test.go |
M
internal/git/archive.go
路路路 15 15 } 16 16 17 17 if err := g.gitCmd(ctx, cmdOpts{ 18 - Cmd: []string{"archive", "--format=tar.gz", ref}, 18 + Cmd: []string{"archive", "--format=tar.gz", "--", ref}, 19 19 Stdout: out, 20 20 }); err != nil { 21 21 return fmt.Errorf("git archive %s: %w", ref, err) 路路路 39 39 var isValidRefRe = regexp.MustCompile(`^[a-zA-Z0-9._/-]+$`) 40 40 41 41 func isValidRef(ref string) bool { 42 - if ref == "" || strings.Contains(ref, "..") { 42 + if ref == "" || strings.Contains(ref, "..") || strings.HasPrefix(ref, "-") { 43 43 return false 44 44 } 45 45 return isValidRefRe.MatchString(ref)
M
internal/git/archive_test.go
路路路 23 23 {name: "branch with dot", ref: "release.1.0", want: true}, 24 24 {name: "branch with hyphen", ref: "bug-fix", want: true}, 25 25 26 + // flag injection prevention 27 + {name: "flag --help", ref: "--help", want: false}, 28 + {name: "flag --output", ref: "--output", want: false}, 29 + {name: "flag -o", ref: "-o", want: false}, 30 + {name: "flag -", ref: "-", want: false}, 31 + 26 32 // security sensitive 27 33 {name: "empty string", ref: "", want: false}, 28 34 {name: "double dot traversal", ref: "..", want: false},