Nemcio/Gogs
1
0
Fork 0
mirror of https://github.com/gogs/gogs.git synced 2026-05-07 10:17:29 +02:00
Code Issues Packages Projects Releases Wiki Activity

dep: update github.com/gogs/git-module to v1.8.4 (#7872)

Browse Source 
Fixes
https://github.com/gogs/gogs/security/advisories/GHSA-m27m-h5gj-wwmg by
including https://github.com/gogs/git-module/pull/110
This commit is contained in:
Joe Chen
2024-12-22 16:37:51 -05:00
parent ce51a8e538
commit 2b0f129a91
5 changed files with 12 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
internal/db/release.go
View File

@@ -125,8 +125,8 @@ func createTag(gitRepo *git.Repository, r *Release) error {
return fmt.Errorf("get branch commit: %v", err)
}
// Trim '--' prefix to prevent command line argument vulnerability.
r.TagName = strings.TrimPrefix(r.TagName, "--")
// 🚨 SECURITY: Trim any leading '-' to prevent command line argument injection.
r.TagName = strings.TrimLeft(r.TagName, "-")
if err = gitRepo.CreateTag(r.TagName, commit.ID.String()); err != nil {
if strings.Contains(err.Error(), "is not a valid tag name") {
return ErrInvalidTagName{r.TagName}

2
internal/db/repo_editor.go
View File

@@ -243,7 +243,7 @@ func (repo *Repository) GetDiffPreview(branch, treePath, content string) (diff *
return nil, fmt.Errorf("write file: %v", err)
}
// 🚨 SECURITY: Prevent including unintended options in the path to the git command.
// 🚨 SECURITY: Prevent including unintended options in the path to the Git command.
cmd := exec.Command("git", "diff", "--end-of-options", treePath)
cmd.Dir = localPath
cmd.Stderr = os.Stderr