gitweb: Use 's' regexp modifier to secure against filenames with LF

Use 's' (treat string as single line) regexp modifier in
git_get_hash_by_path (against future changes, probably unnecessary)
and in parse_ls_tree_line (when called with '-z'=>1 option) to secure
against filenames containing newline.

[jc: the hunk on git_get_hash_by_path was unneeded, and I noticed the
 regexp was doing unnecessary capture, so fixed it up while I was at it.]

Signed-off-by: Jakub Narebski <redacted>
Signed-off-by: Junio C Hamano <redacted>

diff --git a/gitweb.perl b/gitweb.perl
index 8d3d4e4b5252d98280f9d56fab727f91fb1eb0e1d3f91ef76632be0371fe37a8..356e3bdf8da88d4c4e075665e1ab9e5553dc451032e248bfd7ce98bbb9143f72 100755 (executable)
--- a/gitweb.perl
+++ b/gitweb.perl
@@ -877,7 +877,7 @@ sub git_get_hash_by_path {
        close $fd or return undef;
 
        #'100644 blob 0fa3f3a66fb6a137f6ec2c19351ed4d807070ffa  panic.c'
        close $fd or return undef;
 
        #'100644 blob 0fa3f3a66fb6a137f6ec2c19351ed4d807070ffa  panic.c'

-       $line =~ m/^([0-9]+) (.+) ([0-9a-fA-F]{40})\t(.+)$/;
+       $line =~ m/^([0-9]+) (.+) ([0-9a-fA-F]{40})\t/;

        if (defined $type && $type ne $2) {
                # type doesn't match
                return undef;
        if (defined $type && $type ne $2) {
                # type doesn't match
                return undef;


@@ -1302,7 +1302,7 @@ sub parse_ls_tree_line ($;%) {
        my %res;
 
        #'100644 blob 0fa3f3a66fb6a137f6ec2c19351ed4d807070ffa  panic.c'
        my %res;
 
        #'100644 blob 0fa3f3a66fb6a137f6ec2c19351ed4d807070ffa  panic.c'

-       $line =~ m/^([0-9]+) (.+) ([0-9a-fA-F]{40})\t(.+)$/;
+       $line =~ m/^([0-9]+) (.+) ([0-9a-fA-F]{40})\t(.+)$/s;

 
        $res{'mode'} = $1;
        $res{'type'} = $2;
 
        $res{'mode'} = $1;
        $res{'type'} = $2;