| |
@@ -1142,7 +1142,15 @@
|
| |
|
| |
new_repo.checkout("refs/heads/%s" % branch)
|
| |
|
| |
- file_path = os.path.join(newpath, filename)
|
| |
+ # Resolve path to identify path traversal and symlinks
|
| |
+ file_path = os.path.realpath(os.path.join(newpath, filename))
|
| |
+ # Bail out of file path is outside temp repo or inside the .git/ folder
|
| |
+ # Avoids data leak and unauthorized changes in files or git config.
|
| |
+ if (
|
| |
+ not file_path.startswith(newpath)
|
| |
+ or os.path.join(newpath, ".git") in file_path
|
| |
+ ):
|
| |
+ return
|
| |
|
| |
# Get the current index
|
| |
index = new_repo.index
|
| |
wombelix
commented 11 months ago
Bail out if file path is outside the temp repo or inside the '.git/' folder.
This avoids data leak and unauthorized changes in files or git config.
Vulnerability discovered by Thomas Chauchefoin thomas@chauchefoin.fr
Fixes: rhbz#2278745, rhbz#2280725, rhbz#2280723, CVE-2024-4981
Signed-off-by: Dominik Wombacher dominik@wombacher.cc