Merge remote branch 'zts/master'

* zts/master:
  Fixes for handling of invalid p param.  Don't allow directory
  Add tests for p param validation.
  Bump version for first real release.
  Checking in changes prior to tagging of version 0.000000_02.  Changelog diff is:
  Updated Changes.

diff --git a/Changes b/Changes
index f6a472e..0e0ed7d 100644 (file)
--- a/Changes
+++ b/Changes
@@ -1,4 +1,10 @@
 This file documents the revision history for Perl extension Gitalist.
 
+0.000001
+   - No changes since last dev release.
+
+0.000000_02  UNRELEASED
+   - Fixed history action, other minor cleanups.
+
 0.000000_01  UNRELEASED
    - Initial release to CPAN

diff --git a/lib/Gitalist.pm b/lib/Gitalist.pm
index 96ea250..5d4739c 100644 (file)
--- a/lib/Gitalist.pm
+++ b/lib/Gitalist.pm
@@ -13,7 +13,7 @@ use Catalyst qw/
                 StackTrace
 /;
 
-our $VERSION = '0.000000_01';
+our $VERSION = '0.000001';
 $VERSION = eval $VERSION;
 
 __PACKAGE__->config(

diff --git a/lib/Gitalist/Controller/Root.pm b/lib/Gitalist/Controller/Root.pm
index f9e94ad..064ea6d 100644 (file)
--- a/lib/Gitalist/Controller/Root.pm
+++ b/lib/Gitalist/Controller/Root.pm
@@ -636,7 +636,7 @@ sub auto : Private {
       $c->stash(Project => $c->model('GitRepos')->project($project));
     };
     if ($@) {
-      $c->detach('error_404');
+      $c->detach('/error_404');
     }
   }
 
@@ -679,10 +679,7 @@ sub end : ActionClass('RenderView') {
 sub error_404 :Private {
     my ($self, $c) = @_;
     $c->response->status(404);
-    $c->stash(
-        title => 'Page not found',
-        content => 'Page not found',
-    );
+    $c->response->body('Page not found');
 }
 
 sub age_string {

diff --git a/lib/Gitalist/Git/Repo.pm b/lib/Gitalist/Git/Repo.pm
index 4a5d491..b31faff 100644 (file)
--- a/lib/Gitalist/Git/Repo.pm
+++ b/lib/Gitalist/Git/Repo.pm
@@ -66,7 +66,8 @@ name.
 =cut
 
     method project (NonEmptySimpleStr $project) {
-        my $path = $self->repo_dir->subdir($project);
+        my $path = $self->repo_dir->subdir($project)->resolve;
+        die "Directory traversal prohibited" unless $self->repo_dir->contains($path);
         die "Not a valid Project" unless $self->_is_git_repo($path);
         return Project->new( $self->repo_dir->subdir($project) );
     }

diff --git a/t/01app.t b/t/01app.t
index 422e82a..a39a128 100644 (file)
--- a/t/01app.t
+++ b/t/01app.t
@@ -16,8 +16,12 @@ for my $p (qw/ repo1 nodescription /) {
     ok( request($path)->is_success, "$path should succeed");
 }
 
-is request('/summary?p=DoesNotExist')->code, 404,
-    '/summary?p=DoesNotExist 404s';
+my $response = request('/summary?p=DoesNotExist');
+is $response->code, 404, 'invalid project 404s';
+like $response->content, qr/Page not found/, 'invalid project handled correctly';
+
+is request('/summary?p=../../../')->code, 404, 'directory traversal failed';
+
 {
   # URI tests for repo1
   local *test = curry_test_uri('repo1');

diff --git a/t/02git_repo.t b/t/02git_repo.t
index ab35c59..821d5db 100644 (file)
--- a/t/02git_repo.t
+++ b/t/02git_repo.t
@@ -39,5 +39,9 @@ dies_ok {
     my $project = $repo->project();
 } 'throws exception for no project';
 
+dies_ok {
+    my $project = $repo->project('../../../');
+} 'throws exception for directory traversal';
+
 my $project = $repo->project('repo1');
 isa_ok($project, 'Gitalist::Git::Project');