gitweb: add $prevent_xss option to prevent XSS by repository content

[Gitweb] / gitweb.perl

diff --git a/gitweb.perl b/gitweb.perl
index 913edb168767bc7e618396a91f94e31afd03455defc5ea145d6c2a8fe7f4475e..062cf8b5a52d23fb7143ff7c7ae21b7f7de0a1dbcb232e0a37c9b76d581f84a5 100755 (executable)
--- a/gitweb.perl
+++ b/gitweb.perl
@@ -133,6 +133,10 @@ our $fallback_encoding = 'latin1';
 # - one might want to include '-B' option, e.g. '-B', '-M'
 our @diff_opts = ('-M'); # taken from git_commit
 
 # - one might want to include '-B' option, e.g. '-B', '-M'
 our @diff_opts = ('-M'); # taken from git_commit
 

+# Disables features that would allow repository owners to inject script into
+# the gitweb domain.
+our $prevent_xss = 0;
+

 # information about snapshot formats that gitweb is capable of serving
 our %known_snapshot_formats = (
        # name => {
 # information about snapshot formats that gitweb is capable of serving
 our %known_snapshot_formats = (
        # name => {


@@ -4504,7 +4508,9 @@ sub git_summary {
 
        print "</table>\n";
 
 
        print "</table>\n";
 

-       if (-s "$projectroot/$project/README.html") {
+       # If XSS prevention is on, we don't include README.html.
+       # TODO: Allow a readme in some safe format.
+       if (!$prevent_xss && -s "$projectroot/$project/README.html") {

                print "<div class=\"title\">readme</div>\n" .
                      "<div class=\"readme\">\n";
                insert_file("$projectroot/$project/README.html");
                print "<div class=\"title\">readme</div>\n" .
                      "<div class=\"readme\">\n";
                insert_file("$projectroot/$project/README.html");


@@ -4765,10 +4771,21 @@ sub git_blob_plain {
                $save_as .= '.txt';
        }
 
                $save_as .= '.txt';
        }
 

+       # With XSS prevention on, blobs of all types except a few known safe
+       # ones are served with "Content-Disposition: attachment" to make sure
+       # they don't run in our security domain.  For certain image types,
+       # blob view writes an <img> tag referring to blob_plain view, and we
+       # want to be sure not to break that by serving the image as an
+       # attachment (though Firefox 3 doesn't seem to care).
+       my $sandbox = $prevent_xss &&
+               $type !~ m!^(?:text/plain|image/(?:gif|png|jpeg))$!;
+

        print $cgi->header(
                -type => $type,
                -expires => $expires,
        print $cgi->header(
                -type => $type,
                -expires => $expires,

-               -content_disposition => 'inline; filename="' . $save_as . '"');
+               -content_disposition =>
+                       ($sandbox ? 'attachment' : 'inline')
+                       . '; filename="' . $save_as . '"');

        undef $/;
        binmode STDOUT, ':raw';
        print <$fd>;
        undef $/;
        binmode STDOUT, ':raw';
        print <$fd>;