cbrnrd · Nov 12, 2026
diff --git a/internal/servegit/gitservice.go b/internal/servegit/gitservice.go
@@ -93,7 +93,10 @@ func (s *Handler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 	}
 
 	dir, err := s.Dir(ctx, repo)
-	if err != nil {
+	if errors.Is(err, errNotListed) {
+		http.Error(w, "repository not found", http.StatusNotFound)
+		return
+	} else if err != nil {
 		http.Error(w, "failed to determine repository path: "+err.Error(), http.StatusInternalServerError)
 		return
 	}

diff --git a/internal/servegit/serve.go b/internal/servegit/serve.go
@@ -13,6 +13,7 @@ import (
 	"os/exec"
 	pathpkg "path"
 	"path/filepath"
+	"slices"
 	"strings"
 	"time"
 
@@ -104,6 +105,9 @@ func (s *Serve) handler() http.Handler {
 
 	svc := &Handler{
 		Dir: func(_ context.Context, name string) (string, error) {
+			if err := s.checkListed(name); err != nil {
+				return "", err
+			}
 			return filepath.Join(s.Root, filepath.FromSlash(name)), nil
 		},
 		ErrorHook: func(err error, stderr string) {
@@ -139,8 +143,52 @@ func (s *Serve) handler() http.Handler {
 	})
 }
 
+// errNotListed is returned for a repository that Repos does not list.
+var errNotListed = errors.New("repository not found")
+
+// checkListed returns errNotListed unless the repository at the clone path
+// name, relative to /repos/, is one that Repos lists: a repository that is not
+// in a .git directory and not nested in another repository, which Repos does
+// not descend into. A repository's working tree can contain tracked files that
+// Git accepts as a repository, including symlinks to the objects and refs of a
+// repository outside the root, so serving any repository below the root could
+// serve repositories outside it.
+func (s *Serve) checkListed(name string) error {
+	// Repos lists a working tree's repository as <dir>/.git, and the root's
+	// as .git.
+	dir := name
+	if dir == ".git" {
+		dir = ""
+	} else {
+		dir = strings.TrimSuffix(dir, "/.git")
+	}
+	if dir == "" {
+		return nil
+	}
+	if !fs.ValidPath(dir) || dir == "." || slices.Contains(strings.Split(dir, "/"), ".git") {
+		s.Debug.Printf("not serving %q: invalid path or in a .git directory", name)
+		return errNotListed
+	}
+	for parent := pathpkg.Dir(dir); ; parent = pathpkg.Dir(parent) {
+		abs := filepath.Join(s.Root, filepath.FromSlash(parent))
+		if isGitRepo(abs) || isBareRepo(abs) {
+			s.Debug.Printf("not serving %q: nested in repository %q", name, parent)
+			return errNotListed
+		}
+		if parent == "." {
+			return nil
+		}
+	}
+}
+
 // Checks if git thinks the given path is a valid .git folder for a repository
 func isBareRepo(path string) bool {
+	// Git resolves a relative --git-dir against the directory it runs in,
+	// which is path itself.
+	path, err := filepath.Abs(path)
+	if err != nil {
+		return false
+	}
 	c := exec.Command("git", "--git-dir", path, "rev-parse", "--is-bare-repository")
 	c.Dir = path
 	out, err := c.CombinedOutput()

diff --git a/internal/servegit/serve_test.go b/internal/servegit/serve_test.go
@@ -115,6 +115,98 @@ func TestHandlerRejectsGitdirFile(t *testing.T) {
 	}
 }
 
+func TestHandlerServesOnlyListedRepositories(t *testing.T) {
+	root := t.TempDir()
+	privateRepo := filepath.Join(root, "private")
+	if err := os.MkdirAll(privateRepo, 0755); err != nil {
+		t.Fatal(err)
+	}
+	runCmd(t, privateRepo, "git", "init", "-b", "main")
+	runCmd(t, privateRepo, "git", "commit", "--allow-empty", "-m", "private commit")
+	out, err := exec.Command("git", "-C", privateRepo, "rev-parse", "HEAD").Output()
+	if err != nil {
+		t.Fatal(err)
+	}
+	privateHead := strings.TrimSpace(string(out))
+
+	// A repository whose working tree has a directory that Git accepts as a
+	// repository, made of a tracked HEAD and symlinks to the objects and refs
+	// of the private repository outside the served root.
+	attacker := filepath.Join(root, "attacker")
+	if err := os.MkdirAll(filepath.Join(attacker, "evil"), 0755); err != nil {
+		t.Fatal(err)
+	}
+	runCmd(t, attacker, "git", "init", "-b", "main")
+	if err := os.WriteFile(filepath.Join(attacker, "evil", "HEAD"), []byte("ref: refs/heads/main\n"), 0644); err != nil {
+		t.Fatal(err)
+	}
+	for _, name := range []string{"objects", "refs"} {
+		if err := os.Symlink("../../../private/.git/"+name, filepath.Join(attacker, "evil", name)); err != nil {
+			t.Fatal(err)
+		}
+	}
+	runCmd(t, attacker, "git", "add", "evil")
+	runCmd(t, attacker, "git", "commit", "-m", "evil")
+
+	served := filepath.Join(root, "served")
+	runCmd(t, root, "git", "clone", attacker, filepath.Join(served, "public"))
+	runCmd(t, root, "git", "init", "--bare", filepath.Join(served, "dir", "project.bare"))
+	// Git serves the private repository's refs from the embedded directory.
+	runCmd(t, served, "git", "upload-pack", "--strict", "--advertise-refs", filepath.Join(served, "public", "evil"))
+
+	newHandler := func(t *testing.T, root string) http.Handler {
+		rootFS, err := os.OpenRoot(root)
+		if err != nil {
+			t.Fatal(err)
+		}
+		t.Cleanup(func() { rootFS.Close() })
+		return (&Serve{
+			Info:   testLogger(t),
+			Debug:  discardLogger,
+			Addr:   testAddress,
+			Root:   root,
+			RootFS: rootFS,
+		}).handler()
+	}
+	get := func(h http.Handler, target string) *httptest.ResponseRecorder {
+		rec := httptest.NewRecorder()
+		h.ServeHTTP(rec, httptest.NewRequest(http.MethodGet, target, nil))
+		return rec
+	}
+
+	h := newHandler(t, served)
+	for _, tc := range []struct {
+		path string
+		want int
+	}{
+		{path: "/repos/public/.git/info/refs?service=git-upload-pack", want: http.StatusOK},
+		{path: "/repos/dir/project.bare/info/refs?service=git-upload-pack", want: http.StatusOK},
+		{path: "/repos/public/evil/info/refs?service=git-upload-pack", want: http.StatusNotFound},
+		{path: "/repos/public/evil/git-upload-pack", want: http.StatusNotFound},
+		{path: "/repos/dir/project.bare/objects/info/refs?service=git-upload-pack", want: http.StatusNotFound},
+	} {
+		t.Run(tc.path, func(t *testing.T) {
+			rec := get(h, tc.path)
+			if rec.Code != tc.want {
+				t.Errorf("status = %d, want %d; body: %s", rec.Code, tc.want, rec.Body.String())
+			}
+			if strings.Contains(rec.Body.String(), privateHead) {
+				t.Error("the response has the private repository's HEAD")
+			}
+		})
+	}
+
+	t.Run("a root that is a repository serves only itself", func(t *testing.T) {
+		h := newHandler(t, filepath.Join(served, "public"))
+		if rec := get(h, "/repos/.git/info/refs?service=git-upload-pack"); rec.Code != http.StatusOK {
+			t.Errorf("root repository status = %d, want %d", rec.Code, http.StatusOK)
+		}
+		if rec := get(h, "/repos/evil/info/refs?service=git-upload-pack"); rec.Code != http.StatusNotFound {
+			t.Errorf("nested repository status = %d, want %d", rec.Code, http.StatusNotFound)
+		}
+	})
+}
+
 func testReposHandler(t *testing.T, h http.Handler, repos []Repo) {
 	ts := httptest.NewServer(h)
 	t.Cleanup(ts.Close)
@@ -211,6 +303,35 @@ func gitInitRepos(t *testing.T, names ...string) string {
 	return root
 }
 
+func TestReposRelativeRoot(t *testing.T) {
+	root := gitInitRepos(t, "project1", "dir/project2.bare")
+	t.Chdir(filepath.Dir(root))
+	rel := filepath.Base(root)
+
+	rootFS, err := os.OpenRoot(rel)
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { rootFS.Close() })
+
+	repos, err := (&Serve{
+		Info:   testLogger(t),
+		Debug:  discardLogger,
+		Root:   rel,
+		RootFS: rootFS,
+	}).Repos()
+	if err != nil {
+		t.Fatal(err)
+	}
+	want := []Repo{
+		{Name: "dir/project2.bare", URI: "/repos/dir/project2.bare", ClonePath: "/repos/dir/project2.bare"},
+		{Name: "project1", URI: "/repos/project1", ClonePath: "/repos/project1/.git"},
+	}
+	if diff := cmp.Diff(want, repos); diff != "" {
+		t.Errorf("mismatch (-want +got):\n%s", diff)
+	}
+}
+
 func TestIgnoreGitSubmodules(t *testing.T) {
 	root := t.TempDir()