syntax-highlighting.sh: Fix command injection.

[ps-cgit] / ui-snapshot.c

diff --git a/ui-snapshot.c b/ui-snapshot.c
index dbb556484a611040866915a5091ef0574cd9b865..47432bd325759178aa0a30389ae04c11adf340b1 100644 (file)
--- a/ui-snapshot.c
+++ b/ui-snapshot.c
@@ -1,6 +1,7 @@
 /* ui-snapshot.c: generate snapshot of a commit
  *
  * Copyright (C) 2006 Lars Hjemli
+ * Copyright (C) 2012 Jason A. Donenfeld <Jason@zx2c4.com>
  *
  * Licensed under GNU General Public License v2
  *   (see COPYING for full license text)
@@ -10,15 +11,13 @@
 #include "html.h"
 #include "ui-shared.h"
 
-static int write_compressed_tar_archive(struct archiver_args *args,const char *filter)
+static int write_compressed_tar_archive(struct archiver_args *args, char *filter_argv[])
 {
        int rv;
        struct cgit_filter f;
 
-       f.cmd = xstrdup(filter);
-       f.argv = malloc(2 * sizeof(char *));
-       f.argv[0] = f.cmd;
-       f.argv[1] = NULL;
+       f.cmd = filter_argv[0];
+       f.argv = filter_argv;
        cgit_open_filter(&f);
        rv = write_tar_archive(args);
        cgit_close_filter(&f);
@@ -27,19 +26,28 @@ static int write_compressed_tar_archive(struct archiver_args *args,const char *f
 
 static int write_tar_gzip_archive(struct archiver_args *args)
 {
-       return write_compressed_tar_archive(args,"gzip");
+       char *argv[] = { "gzip", "-n", NULL };
+       return write_compressed_tar_archive(args, argv);
 }
 
 static int write_tar_bzip2_archive(struct archiver_args *args)
 {
-       return write_compressed_tar_archive(args,"bzip2");
+       char *argv[] = { "bzip2", NULL };
+       return write_compressed_tar_archive(args, argv);
+}
+
+static int write_tar_xz_archive(struct archiver_args *args)
+{
+       char *argv[] = { "xz", NULL };
+       return write_compressed_tar_archive(args, argv);
 }
 
 const struct cgit_snapshot_format cgit_snapshot_formats[] = {
-       { ".zip", "application/x-zip", write_zip_archive, 0x1 },
-       { ".tar.gz", "application/x-gzip", write_tar_gzip_archive, 0x2 },
-       { ".tar.bz2", "application/x-bzip2", write_tar_bzip2_archive, 0x4 },
-       { ".tar", "application/x-tar", write_tar_archive, 0x8 },
+       { ".zip", "application/x-zip", write_zip_archive, 0x01 },
+       { ".tar.gz", "application/x-gzip", write_tar_gzip_archive, 0x02 },
+       { ".tar.bz2", "application/x-bzip2", write_tar_bzip2_archive, 0x04 },
+       { ".tar", "application/x-tar", write_tar_archive, 0x08 },
+       { ".tar.xz", "application/x-xz", write_tar_xz_archive, 0x10 },
        {}
 };
 
@@ -113,13 +121,11 @@ static const char *get_ref_from_filename(const char *url, const char *filename,
 
        snapshot = xstrdup(filename);
        snapshot[strlen(snapshot) - strlen(format->suffix)] = '\0';
-       fprintf(stderr, "snapshot=%s\n", snapshot);
 
        if (get_sha1(snapshot, sha1) == 0)
                return snapshot;
 
        reponame = cgit_repobasename(url);
-       fprintf(stderr, "reponame=%s\n", reponame);
        if (prefixcmp(snapshot, reponame) == 0) {
                snapshot += strlen(reponame);
                while (snapshot && (*snapshot == '-' || *snapshot == '_'))