From 2803a7ac66636153865e9238e48018b90ace0999 Mon Sep 17 00:00:00 2001
From: Dominik Wombacher <dominik@wombacher.cc>
Date: May 24 2024 14:28:00 +0000
Subject: fix: _update_file_in_git() follows symbolic links in temporary clones


Bail out if file path is outside the temp repo or inside the '.git/' folder.
This avoids data leak and unauthorized changes in files or git config.

Vulnerability discovered by Thomas Chauchefoin <thomas@chauchefoin.fr>

Fixes: rhbz#2278745, rhbz#2280725, rhbz#2280723, CVE-2024-4981

Signed-off-by: Dominik Wombacher <dominik@wombacher.cc>

---

diff --git a/pagure/lib/git.py b/pagure/lib/git.py
index 0224b0d..7bf40fa 100644
--- a/pagure/lib/git.py
+++ b/pagure/lib/git.py
@@ -1142,7 +1142,15 @@ def _update_file_in_git(
 
         new_repo.checkout("refs/heads/%s" % branch)
 
-        file_path = os.path.join(newpath, filename)
+        # Resolve path to identify path traversal and symlinks
+        file_path = os.path.realpath(os.path.join(newpath, filename))
+        # Bail out of file path is outside temp repo or inside the .git/ folder
+        # Avoids data leak and unauthorized changes in files or git config.
+        if (
+            not file_path.startswith(newpath)
+            or os.path.join(newpath, ".git") in file_path
+        ):
+            return
 
         # Get the current index
         index = new_repo.index