From 10a89169c2f2380fef475da9b518ccb5fc07db10 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=D0=BD=D0=B0=D0=B1?= <nabijaczleweli@nabijaczleweli.xyz>
Date: Wed, 5 Aug 2020 20:08:45 +0200
Subject: [PATCH] Verify that repository has a valid name before autocreating
 it

One could trivially push to 'ssh://hg@hg.sr.ht/~n/<script>alert("owo");',
creating a mal-named repo:
  https://twitter.com/nabijaczleweli/status/1290748103981764609
---
 gitsrht-shell/main.go | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/gitsrht-shell/main.go b/gitsrht-shell/main.go
index 449c959..b98f1d4 100644
--- a/gitsrht-shell/main.go
+++ b/gitsrht-shell/main.go
@@ -9,6 +9,7 @@ import (
 	"os/exec"
 	gopath "path"
 	"path/filepath"
+	"regexp"
 	"strconv"
 	"strings"
 	"syscall"
@@ -261,6 +262,13 @@ func main() {
 			}
 
 			if needsAccess == ACCESS_WRITE {
+				if matched, _ := regexp.MatchString(
+					`^[A-Za-z._-][A-Za-z0-9._-]*$`, repoName); !matched {
+
+					log.Println("Name must match [A-Za-z._-][A-Za-z0-9._-]*.")
+					notFound("name policy", nil)
+				}
+
 				repoOwnerId = pusherId
 				repoOwnerName = pusherName
 				repoVisibility = "autocreated"
-- 
2.38.4