diff --git a/internal/http/http.go b/internal/http/http.go
index 5154474c789c5423d9da05d5d33d89831a87b28d..844652d081156b4bb835e3cffdfbe0f6c8fcceea 100644
--- a/internal/http/http.go
+++ b/internal/http/http.go
@@ -2,7 +2,6 @@ package http
import (
"fmt"
- stdhtml "html"
"net/http"
"net/url"
"strings"
@@ -53,7 +52,6 @@ }
func (s Settings) goGet(repo string) string {
u, _ := url.Parse(s.CloneURL)
- repo = stdhtml.EscapeString(repo)
return fmt.Sprintf(`%[1]s`, repo, u.Hostname(), s.CloneURL)
}
diff --git a/internal/http/repo.go b/internal/http/repo.go
index 4eb3f8da37edacee6e7de4671b9eb5d36fbacd4d..d59cb59bd0cb984bc1647f1c06df69f32776215d 100644
--- a/internal/http/repo.go
+++ b/internal/http/repo.go
@@ -78,16 +78,10 @@ return httperr.Error(err)
}
if r.URL.Query().Has("raw") {
- contentType := "text/plain; charset=utf-8"
if r.URL.Query().Has("pretty") {
ext := filepath.Ext(path)
- if mt := mime.TypeByExtension(ext); mt != "" {
- contentType = mt
- }
+ w.Header().Set("Content-Type", mime.TypeByExtension(ext))
}
- w.Header().Set("Content-Type", contentType)
- w.Header().Set("X-Content-Type-Options", "nosniff")
- w.Header().Set("Content-Security-Policy", "script-src 'none'; frame-ancestors 'none'")
w.Write([]byte(content))
return nil
}
diff --git a/internal/ssh/wish.go b/internal/ssh/wish.go
index 64f6be07be25325f7b183186cad75b9bfce16ca6..6bdb16748ec5499af03d1f4683800da71eb612ab 100644
--- a/internal/ssh/wish.go
+++ b/internal/ssh/wish.go
@@ -63,10 +63,6 @@ // checked for access on a per repo basis for a ssh.Session public key.
// Hooks.Push and Hooks.Fetch will be called on successful completion of
// their commands.
func Middleware(repoDir string, cloneURL string, port int, gh Hooks) wish.Middleware {
- repoDirAbs, err := filepath.Abs(repoDir)
- if err != nil {
- repoDirAbs = repoDir
- }
return func(sh ssh.Handler) ssh.Handler {
return func(s ssh.Session) {
sess := Session{s: s}
@@ -79,11 +75,6 @@ // repo should be in the form of "repo.git" or "user/repo.git"
repo := strings.TrimSuffix(strings.TrimPrefix(cmd[1], "/"), "/")
repo = filepath.Clean(repo)
if n := strings.Count(repo, "/"); n > 1 {
- Fatal(s, ErrInvalidRepo)
- return
- }
- // resolved path shouldn't escape repoDir(Abs)
- if abs := filepath.Join(repoDirAbs, repo); !strings.HasPrefix(abs, repoDirAbs+string(filepath.Separator)) {
Fatal(s, ErrInvalidRepo)
return
}