id: e366f211-4815-4f08-8003-56c5b11f8b6b title: serve prepare_git_dir follows a repo.bundle symlink outside www state: closed labels:
- kind:security assignees: [] milestone: null created: 2026-10-27T19:38:26.533319234Z updated: 2026-10-27T19:53:10.623302644Z
Problem
serve's smart-HTTP setup clones www/repo.bundle without the static path's symlink/prefix check. A symlinked bundle pointing outside www is materialized and advertised by /repo.bundle/info/refs, so a local symlink can expose a private repository over HTTP.
Verified:
ln -s /tmp/rev5-private.bundle /tmp/rev5-bundle-www/repo.bundle
hu13 serve --www /tmp/rev5-bundle-www --inbox-dir /tmp/rev5-bundle-inbox --listen 127.0.0.1:39443
curl 'http://127.0.0.1:39443/repo.bundle/info/refs?service=git-upload-pack'
HTTP/1.1 200 OK
Content-Type: application/x-git-upload-pack-advertisement
0000000 0 0 1 e # s e r v i c e = g i t - u p l o a d - p a c k
The normal static /repo.bundle route rejects the outside symlink; only prepare_git_dir follows it. src/serve.rs:119-150.
Fix
Resolve www/repo.bundle and require the target to stay under resolved www (or reject symlinks entirely) before git clone --bare. Add a symlinked-bundle integration test asserting /repo.bundle/info/refs is 404.