Bug Fixes
-
reject control bytes in git daemon requests
Reject NUL, CR, and LF in repository paths and virtual hosts at the shared
git-daemon request serializer before any bytes are written. This addresses
GHSA-rc7h-wp5f-w3g5 without changing URL handling for other transports.The regression exercises both inputs through the shared blocking/async transport
test and verifies that invalid requests produce an error with no output.Git baseline: a02ea57 (
git_connect_git(): forbid newlines in host and path) validates both components before request
construction. Rust byte strings can additionally retain NUL, and CR is rejected
with LF to cover both newline forms.
Commit Statistics
- 2 commits contributed to the release over the course of 7 calendar days.
- 8 days passed between releases.
- 1 commit was understood as conventional.
- 0 issues like '(#ID)' were seen in commit messages