---
id: e366f211-4815-4f08-8003-56c5b11f8b6b
title: serve prepare_git_dir follows a repo.bundle symlink outside www
state: closed
labels:
- kind:security
assignees: []
milestone: null
created: 2026-10-27T19:38:26.533319234Z
updated: 2026-10-27T19:53:10.623302644Z
---
## Problem

`serve`'s smart-HTTP setup clones `www/repo.bundle` without the static path's symlink/prefix check. A symlinked bundle pointing outside `www` is materialized and advertised by `/repo.bundle/info/refs`, so a local symlink can expose a private repository over HTTP.

Verified:

```
ln -s /tmp/rev5-private.bundle /tmp/rev5-bundle-www/repo.bundle
hu13 serve --www /tmp/rev5-bundle-www --inbox-dir /tmp/rev5-bundle-inbox --listen 127.0.0.1:39443
curl 'http://127.0.0.1:39443/repo.bundle/info/refs?service=git-upload-pack'
HTTP/1.1 200 OK
Content-Type: application/x-git-upload-pack-advertisement
0000000 0 0 1 e #   s e r v i c e = g i t - u p l o a d - p a c k
```

The normal static `/repo.bundle` route rejects the outside symlink; only `prepare_git_dir` follows it. `src/serve.rs:119-150`.

## Fix

Resolve `www/repo.bundle` and require the target to stay under resolved `www` (or reject symlinks entirely) before `git clone --bare`. Add a symlinked-bundle integration test asserting `/repo.bundle/info/refs` is 404.