development/git
development/git
1
0
Fork 0
mirror of https://github.com/git/git synced 2024-08-24 18:26:02 +00:00
Code Issues Packages Projects Releases Wiki Activity

gitweb: Handle invalid regexp in regexp search

Browse source 
When using regexp search ('sr' parameter / $search_use_regexp variable
is true), check first that regexp is valid.

Without this patch we would get an error from Perl during search (if
searching is performed by gitweb), or highlighting matches substring
(if applicable), if user provided invalid regexp... which means broken
HTML, with error page (including HTTP headers) generated after gitweb
already produced some output.

Add test that illustrates such error: for example for regexp "*\.git"
we would get the following error:

  Quantifier follows nothing in regex; marked by <-- HERE in m/* <-- HERE \.git/
  at /var/www/cgi-bin/gitweb.cgi line 3084.

Reported-by: Ramsay Jones <ramsay@ramsay1.demon.co.uk>
Signed-off-by: Jakub Narebski <jnareb@gmail.com>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
This commit is contained in:
Jakub Narebski 2012-02-28 19:41:47 +01:00 committed by Junio C Hamano
parent f174a2583c
commit 36612e4daf
2 changed files with 20 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

11
gitweb/gitweb.perl
View file

@ -1054,7 +1054,16 @@ sub evaluate_and_validate_params {
if (length($searchtext) < 2) {
die_error(403, "At least two characters are required for search parameter");
}
$search_regexp = $search_use_regexp ? $searchtext : quotemeta $searchtext;
if ($search_use_regexp) {
$search_regexp = $searchtext;
if (!eval { qr/$search_regexp/; 1; }) {
(my $error = $@) =~ s/ at \S+ line \d+.*\n?//;
die_error(400, "Invalid search regexp '$search_regexp'",
esc_html($error));
}
} else {
$search_regexp = quotemeta $searchtext;
}
}
}

10
t/t9501-gitweb-standalone-http-status.sh
View file

@ -134,4 +134,14 @@ our $maxload = undef;
EOF
# ----------------------------------------------------------------------
# invalid arguments
test_expect_success 'invalid arguments: invalid regexp (in project search)' '
gitweb_run "a=project_list;s=*\.git;sr=1" &&
grep "Status: 400" gitweb.headers &&
grep "400 - Invalid.*regexp" gitweb.body
'
test_debug 'cat gitweb.headers'
test_done