[SECURITY] Several command injections
Nobody has claimed this yet.
Assessment
- Difficulty
- 5/5
- Estimated time
- Over a week
- Newbie friendliness
- 25/100
Research direction
Start by reading the linked sections of src/repo_routes.v, src/commit_routes.v, and src/repo_service.v at the cited lines. Trace the inputs through these paths and audit for other possible injection points. Done means the reported vulnerabilities and any related injection points are addressed and verified without leaving command-injection paths.
Written by the indexing model from the issue text.
Description
There are several command injection vulnerabilities in Gitly:
https://github.com/vlang/gitly/blob/d0e1f3ad2fa3d76306a3de11642f5ff50e9e9ede/src/repo_service.v#L659
I think there are more possible injection points so it is probably not enough to fix these parts only.
If possible, consider Adding a security policy to your repository in the future.
- Dominant language
- V
- Stars
- 1.5k
- Forks
- 79
- PR merge metrics
- No merged PRs in 30d
Getting set up
This project ships no dev container, Dockerfile or contributing guide, so setting up is up to you: start from its README, and see our first-contribution guide for the general steps.
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from vlang/gitly
-
The Gitly demo site is not allowing registration. Accessing the project at https://gitly.org/alex/v returns a 404 Not Found error.May be free again @medvednikov claimed this 507 days ago, and no pull request is open. Open
-
Difficulty 3/5 1-2 days Newbie friendliness 25/100
-
Difficulty 5/5 Over a week Newbie friendliness 15/100
-
Difficulty 5/5 Over a week Newbie friendliness 25/100
-
Difficulty 3/5 1-2 days Newbie friendliness 35/100
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
PedestrianDynamics/pyFDS-Evac#394 ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
python-pillow/Pillow#10087 · 1 comment ·
Maintainers usually reply within 1 day
-
UX
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
ProfessionalWiki/NeoWiki#1573 ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 70/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 68/100