261029.2 · b3fc88424f173bf122cb5e873cfecd44eb137d00
www --public reaches only the open internet and shows nothing of the machine
A visitor names the host www fetches from, so /127.0.0.1:6379/x or a name that leads to 10.0.0.1 made the server probe, clone and list from its own machine and network, and the listing's errors told what answered. Now a public server fetches only from hosts whose every address is on the open internet. git connects only to the addresses checked, through http.curloptResolve, and follows no redirect; this holds for every git call in the cache, a version's blobs included. The listing client checks each address it connects to.
A repo's .git file named the cache's path, and so did a link out of the repo, in its listing and on its page. A public tree now hides .git, by name or by a link to it, and refuses every link out without saying where it leads, whatever marker lies there.
A clone, fetch or checkout stops once the repo outgrows --disk or after 10 minutes, since trim ran only after it, and a forge that sends without end could fill the disk or hold a clone's place for good.
reading declarations
Changes to links.go. All files
@@ -29,6 +29,11 @@ func (f treeFS) Open(name string) (fs.File, error) { if f.t.shared && (isLockName(path.Base(name)) || f.t.dotted(name)) { return nil, &fs.PathError{Op: "open", Path: name, Err: fs.ErrNotExist} }+ // A public tree hides the worktree's .git, which names the cache's+ // path.+ if f.t.public && f.t.inGit(name) {+ return nil, &fs.PathError{Op: "open", Path: name, Err: fs.ErrNotExist}+ } file, err := f.open(name) if err != nil || !f.t.shared { return file, err@@ -44,7 +49,7 @@ func (f treeFS) Open(name string) (fs.File, error) { // lock, or on a share a dot entry. The listing and its version agree, so // a hidden file never reloads the page. func (t *tree) unlisted(dir, n string) bool {- return isLockName(n) || t.shared && t.dotted(path.Join(dir, n))+ return isLockName(n) || t.shared && t.dotted(path.Join(dir, n)) || t.public && dir == "." && n == ".git" } // dotted reports whether name, or where it resolves inside the tree,@@ -61,6 +66,21 @@ func (t *tree) dotted(name string) bool { return err == nil && hasDotName(filepath.ToSlash(rel)) } +// inGit reports whether name, or where it resolves inside the tree, is+// the worktree's .git or below it.+func (t *tree) inGit(name string) bool {+ isGit := func(n string) bool { return n == ".git" || strings.HasPrefix(n, ".git/") }+ if isGit(name) {+ return true+ }+ real, err := filepath.EvalSymlinks(filepath.Join(t.dir, filepath.FromSlash(name)))+ if err != nil || !within(real, t.realDir) {+ return false+ }+ rel, err := filepath.Rel(t.realDir, real)+ return err == nil && isGit(filepath.ToSlash(rel))+}+ // hasDotName reports whether a name on the way to name begins with a dot. func hasDotName(name string) bool { if name == "." {@@ -90,6 +110,13 @@ func (f treeFS) open(name string) (fs.File, error) { } return f.t.root.FS().Open(filepath.ToSlash(rel)) }+ // A stranger's repo never links out: a marker on the machine is+ // the owner's, not the repo's, to grant.+ if f.t.public {+ ref := &refusal{}+ ref.link, ref.target = f.t.outLink(name)+ return nil, ref+ } marker, ref := f.t.follow(name, real) if ref != nil { return nil, ref