Ensure illegal repository names are rejected in create-on-push

diff --git a/src/com/gitblit/GitFilter.java b/src/com/gitblit/GitFilter.java
index c09b0d20388b0c38e26d53f316c88e374125f22b..8ff93b4efb602350f6605828b7a548e0a4a921df 100644 (file)
--- a/src/com/gitblit/GitFilter.java
+++ b/src/com/gitblit/GitFilter.java
@@ -197,6 +197,24 @@ public class GitFilter extends AccessRestrictionFilter {
                if (isPush) {\r
                        if (user.canCreateOnPush(repository)) {\r
                                // user is pushing to a new repository\r
+                               // validate name\r
+                               if (repository.startsWith("../")) {\r
+                                       logger.error(MessageFormat.format("Illegal relative path in repository name! {0}", repository));\r
+                                       return null;\r
+                               }\r
+                               if (repository.contains("/../")) {\r
+                                       logger.error(MessageFormat.format("Illegal relative path in repository name! {0}", repository));\r
+                                       return null;\r
+                               }                                       \r
+\r
+                               // confirm valid characters in repository name\r
+                               Character c = StringUtils.findInvalidCharacter(repository);\r
+                               if (c != null) {\r
+                                       logger.error(MessageFormat.format("Invalid character '{0}' in repository name {1}!", c, repository));\r
+                                       return null;\r
+                               }\r
+\r
+                               // create repository\r
                                RepositoryModel model = new RepositoryModel();\r
                                model.name = repository;\r
                                model.owner = user.username;\r
@@ -213,11 +231,11 @@ public class GitFilter extends AccessRestrictionFilter {
 \r
                                // create the repository\r
                                try {\r
-                                       GitBlit.self().updateRepositoryModel(repository, model, true);\r
-                                       logger.info(MessageFormat.format("{0} created {1} ON-PUSH", user.username, repository));\r
-                                       return GitBlit.self().getRepositoryModel(repository);\r
+                                       GitBlit.self().updateRepositoryModel(model.name, model, true);\r
+                                       logger.info(MessageFormat.format("{0} created {1} ON-PUSH", user.username, model.name));\r
+                                       return GitBlit.self().getRepositoryModel(model.name);\r
                                } catch (GitBlitException e) {\r
-                                       logger.error(MessageFormat.format("{0} failed to create repository {1} ON-PUSH!", user.username, repository), e);\r
+                                       logger.error(MessageFormat.format("{0} failed to create repository {1} ON-PUSH!", user.username, model.name), e);\r
                                }\r
                        } else {\r
                                logger.warn(MessageFormat.format("{0} is not permitted to create repository {1} ON-PUSH!", user.username, repository));\r