dulwich-users team mailing list archive

[Tay Ray Chuan <rctay89@xxxxxxxxx>]

---
 dulwich/repo.py |    8 +++++++-
 1 files changed, 7 insertions(+), 1 deletions(-)

diff --git a/dulwich/repo.py b/dulwich/repo.py
index b1ebd2a..6f58924 100644
--- a/dulwich/repo.py
+++ b/dulwich/repo.py
@@ -1139,7 +1139,13 @@ class Repo(BaseRepo):
         # TODO(dborowitz): sanitize filenames, since this is used directly by
         # the dumb web serving code.
         path = path.lstrip(os.path.sep)
-        path = _norm_path(os.path.join(self.controldir(), path))
+        parent = _norm_path(self.controldir())
+        path = _norm_path(os.path.join(parent, path))
+
+        # check that the file lies in the git directory
+        if not path.startswith(parent):
+            return None
+
         try:
             return open(path, 'rb')
         except (IOError, OSError), e:
-- 
1.7.3.2.msysgit.0