Merge branch 'jn/maint-gitweb-invalid-regexp'

gitster · gitster · commit 6a3a3db73f99 · 2012-03-01T14:44:38.000-08:00
* jn/maint-gitweb-invalid-regexp:
  gitweb: Handle invalid regexp in regexp search
diff --git a/gitweb/gitweb.perl b/gitweb/gitweb.perl
@@ -1081,7 +1081,16 @@ sub evaluate_and_validate_params {
 		if (length($searchtext) < 2) {
 			die_error(403, "At least two characters are required for search parameter");
 		}
-		$search_regexp = $search_use_regexp ? $searchtext : quotemeta $searchtext;
+		if ($search_use_regexp) {
+			$search_regexp = $searchtext;
+			if (!eval { qr/$search_regexp/; 1; }) {
+				(my $error = $@) =~ s/ at \S+ line \d+.*\n?//;
+				die_error(400, "Invalid search regexp '$search_regexp'",
+				          esc_html($error));
+			}
+		} else {
+			$search_regexp = quotemeta $searchtext;
+		}
 	}
 }
 
diff --git a/t/t9501-gitweb-standalone-http-status.sh b/t/t9501-gitweb-standalone-http-status.sh
@@ -134,4 +134,14 @@ our $maxload = undef;
 EOF
 
 
+# ----------------------------------------------------------------------
+# invalid arguments
+
+test_expect_success 'invalid arguments: invalid regexp (in project search)' '
+	gitweb_run "a=project_list;s=*\.git;sr=1" &&
+	grep "Status: 400" gitweb.headers &&
+	grep "400 - Invalid.*regexp" gitweb.body
+'
+test_debug 'cat gitweb.headers'
+
 test_done

Original file line number	Diff line number	Diff line change
`@@ -1081,7 +1081,16 @@ sub evaluate_and_validate_params {`
`1081`	`1081`	`if (length($searchtext) < 2) {`
`1082`	`1082`	`die_error(403, "At least two characters are required for search parameter");`
`1083`	`1083`	`}`
`1084`		`- $search_regexp = $search_use_regexp ? $searchtext : quotemeta $searchtext;`
	`1084`	`+ if ($search_use_regexp) {`
	`1085`	`+ $search_regexp = $searchtext;`
	`1086`	`+ if (!eval { qr/$search_regexp/; 1; }) {`
	`1087`	`+ (my $error = $@) =~ s/ at \S+ line \d+.*\n?//;`
	`1088`	`+ die_error(400, "Invalid search regexp '$search_regexp'",`
	`1089`	`+ esc_html($error));`
	`1090`	`+ }`
	`1091`	`+ } else {`
	`1092`	`+ $search_regexp = quotemeta $searchtext;`
	`1093`	`+ }`
`1085`	`1094`	`}`
`1086`	`1095`	`}`
`1087`	`1096`