Skip to content

Commit 080a29c

Browse files
committed
Verify git checkout path is in site directory
This is unlikely, as we verify inputs come from GitHub using signatures, but it's best to be safe about this.
1 parent 61de8b0 commit 080a29c

File tree

1 file changed

+4
-2
lines changed

1 file changed

+4
-2
lines changed

webhook.py

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -156,8 +156,10 @@ async def github_webhook(request: web.Request):
156156
delivery, ref, expected_branch)
157157
return web.Response(status=200)
158158

159-
checkout = Path(os.environ.get('SITE_DIR', 'sites'), repository)
160-
if not (checkout / '.git').is_dir():
159+
site_dir = Path(os.environ.get('SITE_DIR', 'sites'))
160+
checkout = (site_dir / repository).resolve()
161+
if (not checkout.is_relative_to(site_dir) or
162+
not (checkout / '.git').is_dir()):
161163
raise web.HTTPInternalServerError(
162164
reason=(f'{delivery}: Checkout for {organization}/{repository} '
163165
'does not exist'))

0 commit comments

Comments
 (0)