Severity: high Category: security Location:src/shared/file.c:129-138, src/shared/file.c:328, src/server/server.c:41-55
Description:
Received file paths are used directly to construct destination paths via path_cat(config->receive_root_directory, file->path) without validation. A malicious client can send paths containing .. components, absolute paths (/etc/passwd), or embedded null bytes, causing the server to write outside the intended destination directory.
For example, a client sending path = "../../../etc/cron.d/fastsync" could overwrite system files when the server runs with sufficient privileges.
Suggested fix:
In file_save_to_disk() and receive_incremental_check(), canonicalize and validate the received relative path:
Reject absolute paths.
Reject any path component equal to ...
Reject embedded null bytes.
Resolve the cleaned relative path under the destination root using openat(dest_fd, rel_path, O_NOFOLLOW) or equivalent to prevent symlink traversal.
Consider running the per-connection handler in a chroot or with O_NOFOLLOW flags for destination directories.
Labels: security, path-traversal
**Severity:** high
**Category:** security
**Location:** `src/shared/file.c:129-138`, `src/shared/file.c:328`, `src/server/server.c:41-55`
**Description:**
Received file paths are used directly to construct destination paths via `path_cat(config->receive_root_directory, file->path)` without validation. A malicious client can send paths containing `..` components, absolute paths (`/etc/passwd`), or embedded null bytes, causing the server to write outside the intended destination directory.
For example, a client sending `path = "../../../etc/cron.d/fastsync"` could overwrite system files when the server runs with sufficient privileges.
**Suggested fix:**
1. In `file_save_to_disk()` and `receive_incremental_check()`, canonicalize and validate the received relative path:
- Reject absolute paths.
- Reject any path component equal to `..`.
- Reject embedded null bytes.
2. Resolve the cleaned relative path under the destination root using `openat(dest_fd, rel_path, O_NOFOLLOW)` or equivalent to prevent symlink traversal.
3. Consider running the per-connection handler in a chroot or with `O_NOFOLLOW` flags for destination directories.
**Labels:** security, path-traversal
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Severity: high
Category: security
Location:
src/shared/file.c:129-138,src/shared/file.c:328,src/server/server.c:41-55Description:
Received file paths are used directly to construct destination paths via
path_cat(config->receive_root_directory, file->path)without validation. A malicious client can send paths containing..components, absolute paths (/etc/passwd), or embedded null bytes, causing the server to write outside the intended destination directory.For example, a client sending
path = "../../../etc/cron.d/fastsync"could overwrite system files when the server runs with sufficient privileges.Suggested fix:
file_save_to_disk()andreceive_incremental_check(), canonicalize and validate the received relative path:...openat(dest_fd, rel_path, O_NOFOLLOW)or equivalent to prevent symlink traversal.O_NOFOLLOWflags for destination directories.Labels: security, path-traversal