Fixes for handling of invalid p param. Don't allow directory

traveral, and don't try to render a template.

diff --git a/lib/Gitalist/Controller/Root.pm b/lib/Gitalist/Controller/Root.pm
index f9e94ad..064ea6d 100644 (file)
--- a/lib/Gitalist/Controller/Root.pm
+++ b/lib/Gitalist/Controller/Root.pm
@@ -636,7 +636,7 @@ sub auto : Private {
       $c->stash(Project => $c->model('GitRepos')->project($project));
     };
     if ($@) {
-      $c->detach('error_404');
+      $c->detach('/error_404');
     }
   }
 
@@ -679,10 +679,7 @@ sub end : ActionClass('RenderView') {
 sub error_404 :Private {
     my ($self, $c) = @_;
     $c->response->status(404);
-    $c->stash(
-        title => 'Page not found',
-        content => 'Page not found',
-    );
+    $c->response->body('Page not found');
 }
 
 sub age_string {

diff --git a/lib/Gitalist/Git/Repo.pm b/lib/Gitalist/Git/Repo.pm
index 4a5d491..b31faff 100644 (file)
--- a/lib/Gitalist/Git/Repo.pm
+++ b/lib/Gitalist/Git/Repo.pm
@@ -66,7 +66,8 @@ name.
 =cut
 
     method project (NonEmptySimpleStr $project) {
-        my $path = $self->repo_dir->subdir($project);
+        my $path = $self->repo_dir->subdir($project)->resolve;
+        die "Directory traversal prohibited" unless $self->repo_dir->contains($path);
         die "Not a valid Project" unless $self->_is_git_repo($path);
         return Project->new( $self->repo_dir->subdir($project) );
     }

diff --git a/t/02git_repo.t b/t/02git_repo.t
index ab35c59..821d5db 100644 (file)
--- a/t/02git_repo.t
+++ b/t/02git_repo.t
@@ -39,5 +39,9 @@ dies_ok {
     my $project = $repo->project();
 } 'throws exception for no project';
 
+dies_ok {
+    my $project = $repo->project('../../../');
+} 'throws exception for directory traversal';
+
 my $project = $repo->project('repo1');
 isa_ok($project, 'Gitalist::Git::Project');