65 lines
3.0 KiB
TypeScript
65 lines
3.0 KiB
TypeScript
/**
|
|
* Deny-list validation for user-supplied git repo URLs and refs, kept in its OWN
|
|
* import-light module (no db/sqlite) so it is unit-testable. git.ts re-exports and
|
|
* calls these before any git subprocess.
|
|
*
|
|
* These reject inputs that git would execute as a command / read as a local file /
|
|
* parse as an OPTION. Every legitimate scheme (https, http, ssh, git, scp-like
|
|
* git@host:path) passes unchanged, so this is fully backward-compatible.
|
|
*/
|
|
|
|
import { resolve, sep, join, dirname } from 'node:path';
|
|
|
|
export function assertSafeRepoUrl(url: string): void {
|
|
const u = (url || '').trim();
|
|
if (!u) throw new Error('Repository URL is required');
|
|
// A value starting with '-' is consumed by git as an option (e.g. --upload-pack=).
|
|
if (u.startsWith('-')) throw new Error('Invalid repository URL');
|
|
// git's ext::/fd:: transports execute a command; file:// reads local paths.
|
|
const lower = u.toLowerCase();
|
|
if (lower.startsWith('ext::') || lower.startsWith('fd::') || lower.startsWith('file://')) {
|
|
throw new Error('Unsupported repository URL transport');
|
|
}
|
|
// A bare local filesystem path (no scheme, no scp-like host:) is not a remote.
|
|
if (u.startsWith('/') || u.startsWith('./') || u.startsWith('../')) {
|
|
throw new Error('Repository URL must be a remote (https/ssh/git), not a local path');
|
|
}
|
|
}
|
|
|
|
/** A git ref (branch/tag) must not be parseable as an option. Empty is allowed
|
|
* (callers fall back to a default like HEAD). */
|
|
export function assertSafeGitRef(ref: string | null | undefined): void {
|
|
const r = (ref || '').trim();
|
|
if (r && r.startsWith('-')) throw new Error('Invalid branch/ref name');
|
|
}
|
|
|
|
/**
|
|
* Resolve a user-supplied path (composePath / envFilePath) INSIDE the clone dir,
|
|
* throwing if it would ESCAPE the clone. Uses resolve-then-containment (like a plain
|
|
* `join` + escape check): an in-repo `..` (e.g. `stacks/../compose.yml`) or a leading
|
|
* `./` still resolve, only a path that escapes the clone is refused. A leading `/` is
|
|
* treated as repo-root-relative (`/qbittorrent/compose.yaml` -> `qbittorrent/compose.yaml`)
|
|
* since the clone is the root the user reasons about; the containment check below still
|
|
* blocks any real escape (`/../x` -> `../x` -> refused). `label` names the field for the
|
|
* error message.
|
|
*/
|
|
export function repoFilePath(repoPath: string, userRel: string, label: string): string {
|
|
const rel = userRel.replace(/^\/+/, '');
|
|
const abs = resolve(repoPath, rel);
|
|
if (abs !== repoPath && !abs.startsWith(repoPath + sep)) {
|
|
throw new Error(`${label} must be a path inside the repository (got "${userRel}")`);
|
|
}
|
|
return abs;
|
|
}
|
|
|
|
/**
|
|
* Absolute path of the base `.env` that sits beside a compose file inside a clone. The
|
|
* compose path is resolved through repoFilePath (containment-checked, ABSOLUTE), so the
|
|
* `.env` is just its sibling - NOT re-joined onto repoPath, which would double the prefix
|
|
* (#1495).
|
|
*/
|
|
export function repoBaseEnvPath(repoPath: string, composeUserPath: string): string {
|
|
const safeComposePath = repoFilePath(repoPath, composeUserPath, 'Compose path');
|
|
return join(dirname(safeComposePath), '.env');
|
|
}
|