commit 26b163a03e920e099a9aeefaeb6e99d0e0a8baf9
from: Omar Polo <op@omarpolo.com>
date: Tue Jan 30 10:26:42 2024 UTC

gotwebd: guard against missig folder and file parameter in BLOB and BLAME

ok stsp

commit - d4fbd6eb2ce77846055692cfe05c18e8fabe2dca
commit + 26b163a03e920e099a9aeefaeb6e99d0e0a8baf9
blob - 09c4ddba2490572fbc8bbc7dd65fcc63ca5eb5bf
blob + c9ba8e6ff4b8c298080a89dcbc845342b7d0cd88
--- gotwebd/got_operations.c
+++ gotwebd/got_operations.c
@@ -1005,8 +1005,7 @@ got_output_file_blame(struct request *c, got_render_bl
 	bca.lines = NULL;
 	bca.cb = cb;
 
-	if (asprintf(&path, "%s%s%s", qs->folder ? qs->folder : "",
-	    qs->folder ? "/" : "", qs->file) == -1) {
+	if (asprintf(&path, "%s/%s", qs->folder, qs->file) == -1) {
 		error = got_error_from_errno("asprintf");
 		goto done;
 	}
blob - 62d7787e1646b5e3c0bf02940f4da590182f7c29
blob + 84f26236147f048cca67613f9b3a2dfbf061ed03
--- gotwebd/gotweb.c
+++ gotwebd/gotweb.c
@@ -206,6 +206,11 @@ gotweb_process_request(struct request *c)
 	}
 
 	if (qs->action == BLOBRAW || qs->action == BLOB) {
+		if (qs->folder == NULL || qs->file == NULL) {
+			error = got_error(GOT_ERR_BAD_QUERYSTRING);
+			goto err;
+		}
+
 		error = got_get_repo_commits(c, 1);
 		if (error)
 			goto err;
@@ -218,6 +223,10 @@ gotweb_process_request(struct request *c)
 
 	switch (qs->action) {
 	case BLAME:
+		if (qs->folder == NULL || qs->file == NULL) {
+			error = got_error(GOT_ERR_BAD_QUERYSTRING);
+			goto err;
+		}
 		error = got_get_repo_commits(c, 1);
 		if (error) {
 			log_warnx("%s: %s", __func__, error->msg);