gitweb: No error messages with unescaped/unprotected user input

diff --git a/rsh.c b/rsh.c
index bcb1c80d84b77e04bf843c2b38592284760ae165..07166addd9629675c4b0c7c065564a283014b69d 100644 (file)
--- a/rsh.c
+++ b/rsh.c
@@ -1,13 +1,42 @@
-#include "rsh.h"
-
 #include <string.h>
 #include <sys/types.h>
 #include <sys/socket.h>
 
+#include "rsh.h"
+#include "quote.h"
 #include "cache.h"
 
 #define COMMAND_SIZE 4096
 
+/*
+ * Append a string to a string buffer, with or without shell quoting.
+ * Return true if the buffer overflowed.
+ */
+static int add_to_string(char **ptrp, int *sizep, const char *str, int quote)
+{
+       char *p = *ptrp;
+       int size = *sizep;
+       int oc;
+       int err = 0;
+
+       if ( quote ) {
+               oc = sq_quote_buf(p, size, str);
+       } else {
+               oc = strlen(str);
+               memcpy(p, str, (oc >= size) ? size-1 : oc);
+       }
+
+       if ( oc >= size ) {
+               err = 1;
+               oc = size-1;
+       }
+
+       *ptrp  += oc;
+       **ptrp  = '\0';
+       *sizep -= oc;
+       return err;
+}
+
 int setup_connection(int *fd_in, int *fd_out, const char *remote_prog, 
                     char *url, int rmt_argc, char **rmt_argv)
 {
@@ -16,7 +45,10 @@ int setup_connection(int *fd_in, int *fd_out, const char *remote_prog,
        int sv[2];
        char command[COMMAND_SIZE];
        char *posn;
+       int sizen;
+       int of;
        int i;
+       pid_t pid;
 
        if (!strcmp(url, "-")) {
                *fd_in = 0;
@@ -37,27 +69,37 @@ int setup_connection(int *fd_in, int *fd_out, const char *remote_prog,
        if (!path) {
                return error("Bad URL: %s", url);
        }
-       /* ssh <host> 'cd <path>; stdio-pull <arg...> <commit-id>' */
-       snprintf(command, COMMAND_SIZE, 
-                "%s='%s' %s",
-                GIT_DIR_ENVIRONMENT, path, remote_prog);
-       *path = '\0';
-       posn = command + strlen(command);
-       for (i = 0; i < rmt_argc; i++) {
-               *(posn++) = ' ';
-               strncpy(posn, rmt_argv[i], COMMAND_SIZE - (posn - command));
-               posn += strlen(rmt_argv[i]);
-               if (posn - command + 4 >= COMMAND_SIZE) {
-                       return error("Command line too long");
-               }
+       /* $GIT_RSH <host> "env GIT_DIR=<path> <remote_prog> <args...>" */
+       sizen = COMMAND_SIZE;
+       posn = command;
+       of = 0;
+       of |= add_to_string(&posn, &sizen, "env ", 0);
+       of |= add_to_string(&posn, &sizen, GIT_DIR_ENVIRONMENT "=", 0);
+       of |= add_to_string(&posn, &sizen, path, 1);
+       of |= add_to_string(&posn, &sizen, " ", 0);
+       of |= add_to_string(&posn, &sizen, remote_prog, 1);
+
+       for ( i = 0 ; i < rmt_argc ; i++ ) {
+               of |= add_to_string(&posn, &sizen, " ", 0);
+               of |= add_to_string(&posn, &sizen, rmt_argv[i], 1);
        }
-       strcpy(posn, " -");
-       if (socketpair(AF_UNIX, SOCK_STREAM, 0, sv)) {
+
+       of |= add_to_string(&posn, &sizen, " -", 0);
+
+       if ( of )
+               return error("Command line too long");
+
+       if (socketpair(AF_UNIX, SOCK_STREAM, 0, sv))
                return error("Couldn't create socket");
-       }
-       if (!fork()) {
-               const char *ssh = getenv("GIT_SSH") ? : "ssh";
-               const char *ssh_basename = strrchr(ssh, '/');
+
+       pid = fork();
+       if (pid < 0)
+               return error("Couldn't fork");
+       if (!pid) {
+               const char *ssh, *ssh_basename;
+               ssh = getenv("GIT_SSH");
+               if (!ssh) ssh = "ssh";
+               ssh_basename = strrchr(ssh, '/');
                if (!ssh_basename)
                        ssh_basename = ssh;
                else