From 5139c88a4bc164a2e024323f0fa1e7965b5cdeda Mon Sep 17 00:00:00 2001
From: tjh <x@tjh.dev>
Date: Wed, 14 May 2025 10:46:06 +0100
Subject: [PATCH] knotserver: reject '{did}/{name}/git-receive-pack' requests

---
 knotserver/git.go     | 13 +++++++++++++
 knotserver/handler.go |  1 +
 2 files changed, 14 insertions(+)

diff --git a/knotserver/git.go b/knotserver/git.go
index d6dc50ad..e035b284 100644
--- a/knotserver/git.go
+++ b/knotserver/git.go
@@ -93,6 +93,19 @@ func (d *Handle) UploadPack(w http.ResponseWriter, r *http.Request) {
 	}
 }
 
+func (d *Handle) ReceivePack(w http.ResponseWriter, r *http.Request) {
+	did := chi.URLParam(r, "did")
+	name := chi.URLParam(r, "name")
+	_, err := securejoin.SecureJoin(d.c.Repo.ScanPath, filepath.Join(did, name))
+	if err != nil {
+		gitError(w, err.Error(), http.StatusForbidden)
+		d.l.Error("git: failed to secure join repo path", "handler", "ReceivePack", "error", err)
+		return
+	}
+
+	d.RejectPush(w, r, name)
+}
+
 func (d *Handle) RejectPush(w http.ResponseWriter, r *http.Request, unqualifiedRepoName string) {
 	// A text/plain response will cause git to print each line of the body
 	// prefixed with "remote: ".
diff --git a/knotserver/handler.go b/knotserver/handler.go
index f3b42391..ab179535 100644
--- a/knotserver/handler.go
+++ b/knotserver/handler.go
@@ -83,6 +83,7 @@ func Setup(ctx context.Context, c *config.Config, db *db.DB, e *rbac.Enforcer, j
 			r.Get("/", h.RepoIndex)
 			r.Get("/info/refs", h.InfoRefs)
 			r.Post("/git-upload-pack", h.UploadPack)
+			r.Post("/git-receive-pack", h.ReceivePack)
 			r.Get("/compare/{rev1}/{rev2}", h.Compare) // git diff-tree compare of two objects
 
 			r.With(h.VerifySignature).Post("/hidden-ref/{forkRef}/{remoteRef}", h.NewHiddenRef)
-- 
2.51.2