From 0a78d99a4db96c5181678acc46ca3dcc0d10c2b2 Mon Sep 17 00:00:00 2001 From: Unknwon Date: Fri, 6 May 2016 15:40:41 -0400 Subject: [PATCH] models/release: filter input to prevent command line argument vulnerability --- README.md | 2 +- conf/locale/TRANSLATORS | 1 + gogs.go | 2 +- models/issue.go | 8 +-- models/release.go | 2 + public/config.codekit | 122 +--------------------------------------- templates/.VERSION | 2 +- 7 files changed, 11 insertions(+), 128 deletions(-) diff --git a/README.md b/README.md index 705d097c97..3f0c728fee 100644 --- a/README.md +++ b/README.md @@ -3,7 +3,7 @@ Gogs - Go Git Service [![Build Status](https://travis-ci.org/gogits/gogs.svg?bra ![](https://github.com/gogits/gogs/blob/master/public/img/gogs-large-resize.png?raw=true) -##### Current version: 0.9.23 +##### Current version: 0.9.24 | Web | UI | Preview | |:-------------:|:-------:|:-------:| diff --git a/conf/locale/TRANSLATORS b/conf/locale/TRANSLATORS index 16b1cb5b96..1808a45388 100644 --- a/conf/locale/TRANSLATORS +++ b/conf/locale/TRANSLATORS @@ -23,6 +23,7 @@ Dmitriy Nogay Enrico Testori hypertesto AT gmail DOT com Ezequiel Gonzalez Rial Gregor Santner +Halil Kaya Hamid Feizabadi Huimin Wang ilko diff --git a/gogs.go b/gogs.go index 73fc00c2c1..9fe56aaa97 100644 --- a/gogs.go +++ b/gogs.go @@ -17,7 +17,7 @@ import ( "github.com/gogits/gogs/modules/setting" ) -const APP_VER = "0.9.23.0426" +const APP_VER = "0.9.25.0506" func init() { runtime.GOMAXPROCS(runtime.NumCPU()) diff --git a/models/issue.go b/models/issue.go index 27df4796a1..f16382ba14 100644 --- a/models/issue.go +++ b/models/issue.go @@ -546,9 +546,9 @@ func Issues(opts *IssuesOptions) ([]*Issue, error) { sess.Desc("created_unix") } - if opts.Labels != "0" { + if len(opts.Labels) > 0 && opts.Labels != "0" { labelIDs := base.StringsToInt64s(strings.Split(opts.Labels, ",")) - if opts.Labels != "" && len(labelIDs) > 0 { + if len(labelIDs) > 0 { sess.Join("INNER", "issue_label", "issue.id = issue_label.issue_id").In("label_id", labelIDs) } } @@ -785,9 +785,9 @@ func GetIssueStats(opts *IssueStatsOptions) *IssueStats { countSession := func(opts *IssueStatsOptions) *xorm.Session { sess := x.Where("issue.repo_id = ?", opts.RepoID).And("is_pull = ?", opts.IsPull) - if opts.Labels != "0" { + if len(opts.Labels) > 0 && opts.Labels != "0" { labelIDs := base.StringsToInt64s(strings.Split(opts.Labels, ",")) - if opts.Labels != "" && len(labelIDs) > 0 { + if len(labelIDs) > 0 { sess.Join("INNER", "issue_label", "issue.id = issue_id").In("label_id", labelIDs) } } diff --git a/models/release.go b/models/release.go index 69ce6c139d..026ab8ff5c 100644 --- a/models/release.go +++ b/models/release.go @@ -67,6 +67,8 @@ func createTag(gitRepo *git.Repository, rel *Release) error { return fmt.Errorf("GetBranchCommit: %v", err) } + // Trim '--' prefix to prevent command line argument vulnerability + rel.TagName = strings.TrimPrefix(rel.TagName, "--") if err = gitRepo.CreateTag(rel.TagName, commit.ID.String()); err != nil { return err } diff --git a/public/config.codekit b/public/config.codekit index 5c5be3c1a5..d22014edc3 100644 --- a/public/config.codekit +++ b/public/config.codekit @@ -431,126 +431,6 @@ "strictImports": 0, "strictMath": 0, "strictUnits": 0 - }, - "\/plugins\/dropzone-4.2.0\/dropzone.css": { - "fileType": 16, - "ignore": 0, - "ignoreWasSetByUser": 0, - "inputAbbreviatedPath": "\/plugins\/dropzone-4.2.0\/dropzone.css", - "outputAbbreviatedPath": "No Output Path", - "outputPathIsOutsideProject": 0, - "outputPathIsSetByUser": 0 - }, - "\/plugins\/dropzone-4.2.0\/dropzone.js": { - "fileType": 64, - "ignore": 0, - "ignoreWasSetByUser": 0, - "inputAbbreviatedPath": "\/plugins\/dropzone-4.2.0\/dropzone.js", - "outputAbbreviatedPath": "\/plugins\/dropzone-4.2.0\/min\/dropzone-min.js", - "outputPathIsOutsideProject": 0, - "outputPathIsSetByUser": 0, - "outputStyle": 1, - "syntaxCheckerStyle": 1 - }, - "\/plugins\/highlight-9.2.0\/default.css": { - "fileType": 16, - "ignore": 0, - "ignoreWasSetByUser": 0, - "inputAbbreviatedPath": "\/plugins\/highlight-9.2.0\/default.css", - "outputAbbreviatedPath": "No Output Path", - "outputPathIsOutsideProject": 0, - "outputPathIsSetByUser": 0 - }, - "\/plugins\/highlight-9.2.0\/github.css": { - "fileType": 16, - "ignore": 0, - "ignoreWasSetByUser": 0, - "inputAbbreviatedPath": "\/plugins\/highlight-9.2.0\/github.css", - "outputAbbreviatedPath": "No Output Path", - "outputPathIsOutsideProject": 0, - "outputPathIsSetByUser": 0 - }, - "\/plugins\/highlight-9.2.0\/highlight.pack.js": { - "fileType": 64, - "ignore": 0, - "ignoreWasSetByUser": 0, - "inputAbbreviatedPath": "\/plugins\/highlight-9.2.0\/highlight.pack.js", - "outputAbbreviatedPath": "\/plugins\/highlight-9.2.0\/min\/highlight.pack-min.js", - "outputPathIsOutsideProject": 0, - "outputPathIsSetByUser": 0, - "outputStyle": 1, - "syntaxCheckerStyle": 1 - }, - "\/plugins\/jquery.datetimepicker-2.4.5\/jquery.datetimepicker.css": { - "fileType": 16, - "ignore": 0, - "ignoreWasSetByUser": 0, - "inputAbbreviatedPath": "\/plugins\/jquery.datetimepicker-2.4.5\/jquery.datetimepicker.css", - "outputAbbreviatedPath": "No Output Path", - "outputPathIsOutsideProject": 0, - "outputPathIsSetByUser": 0 - }, - "\/plugins\/jquery.datetimepicker-2.4.5\/jquery.datetimepicker.js": { - "fileType": 64, - "ignore": 0, - "ignoreWasSetByUser": 0, - "inputAbbreviatedPath": "\/plugins\/jquery.datetimepicker-2.4.5\/jquery.datetimepicker.js", - "outputAbbreviatedPath": "\/plugins\/jquery.datetimepicker-2.4.5\/min\/jquery.datetimepicker-min.js", - "outputPathIsOutsideProject": 0, - "outputPathIsSetByUser": 0, - "outputStyle": 1, - "syntaxCheckerStyle": 1 - }, - "\/plugins\/jquery.minicolors-2.2.3\/jquery.minicolors.css": { - "fileType": 16, - "ignore": 0, - "ignoreWasSetByUser": 0, - "inputAbbreviatedPath": "\/plugins\/jquery.minicolors-2.2.3\/jquery.minicolors.css", - "outputAbbreviatedPath": "No Output Path", - "outputPathIsOutsideProject": 0, - "outputPathIsSetByUser": 0 - }, - "\/plugins\/jquery.minicolors-2.2.3\/jquery.minicolors.min.js": { - "fileType": 64, - "ignore": 0, - "ignoreWasSetByUser": 0, - "inputAbbreviatedPath": "\/plugins\/jquery.minicolors-2.2.3\/jquery.minicolors.min.js", - "outputAbbreviatedPath": "\/plugins\/jquery.minicolors-2.2.3\/min\/jquery.minicolors.min-min.js", - "outputPathIsOutsideProject": 0, - "outputPathIsSetByUser": 0, - "outputStyle": 1, - "syntaxCheckerStyle": 1 - }, - "\/plugins\/jquery.minicolors-2.2.3\/jquery.minicolors.png": { - "fileType": 32768, - "ignore": 0, - "ignoreWasSetByUser": 0, - "initialSize": 68627, - "inputAbbreviatedPath": "\/plugins\/jquery.minicolors-2.2.3\/jquery.minicolors.png", - "outputAbbreviatedPath": "\/plugins\/jquery.minicolors-2.2.3\/jquery.minicolors.png", - "outputPathIsOutsideProject": 0, - "outputPathIsSetByUser": 0, - "processed": 0 - }, - "\/plugins\/simplemde-1.10.1\/simplemde.min.css": { - "fileType": 16, - "ignore": 0, - "ignoreWasSetByUser": 0, - "inputAbbreviatedPath": "\/plugins\/simplemde-1.10.1\/simplemde.min.css", - "outputAbbreviatedPath": "No Output Path", - "outputPathIsOutsideProject": 0, - "outputPathIsSetByUser": 0 - }, - "\/plugins\/simplemde-1.10.1\/simplemde.min.js": { - "fileType": 64, - "ignore": 0, - "ignoreWasSetByUser": 0, - "inputAbbreviatedPath": "\/plugins\/simplemde-1.10.1\/simplemde.min.js", - "outputAbbreviatedPath": "\/plugins\/simplemde-1.10.1\/min\/simplemde.min-min.js", - "outputPathIsOutsideProject": 0, - "outputPathIsSetByUser": 0, - "outputStyle": 1, - "syntaxCheckerStyle": 1 } }, "hooks": [ @@ -1162,7 +1042,7 @@ "sassUseLibsass": 0, "shouldRunAutoprefixer": 0, "shouldRunBless": 0, - "skippedItemsString": "node_modules, _logs, .hg, _cache, log, logs, cache, \/assets, \/js\/libs, .git, .svn, \/img\/emoji", + "skippedItemsString": "node_modules, _logs, .hg, \/plugins, _cache, log, logs, cache, \/assets, \/js\/libs, .git, .svn, \/img\/emoji", "slimAutoOutputPathEnabled": 1, "slimAutoOutputPathFilenamePattern": "*.html", "slimAutoOutputPathRelativePath": "", diff --git a/templates/.VERSION b/templates/.VERSION index dd22f4e0a5..cec1f08732 100644 --- a/templates/.VERSION +++ b/templates/.VERSION @@ -1 +1 @@ -0.9.23.0426 \ No newline at end of file +0.9.25.0506 \ No newline at end of file