From 67083d3173197c0a247f7b32300ee007749fa939 Mon Sep 17 00:00:00 2001
From: Runxi Yu <me@runxiyu.org>
Date: Fri, 07 Mar 2025 20:25:30 +0800
Subject: [PATCH] repo/index: Emit warning when path contains newline

---
 http_handle_repo_index.go |  7 +++++++
 static/style.css          |  8 ++++++++
 templates/repo_index.tmpl |  6 ++++++
 utils.go                  | 15 +++++++++++++++

diff --git a/http_handle_repo_index.go b/http_handle_repo_index.go
index 15b51739f73b06e0757dfded81b4d228b189d7bb..6ac9b07e3ee20c01d4fc2a49e0bc7e2acf1c05b9 100644
--- a/http_handle_repo_index.go
+++ b/http_handle_repo_index.go
@@ -5,6 +5,7 @@ package main
 
 import (
 	"net/http"
+	"strings"
 
 	"github.com/go-git/go-git/v5"
 	"github.com/go-git/go-git/v5/plumbing"
@@ -20,8 +21,13 @@ 	var err error
 	var recent_commits []*object.Commit
 	var commit_object *object.Commit
 	var tree *object.Tree
+	var notes []string
 
 	repo, repo_name, group_path = params["repo"].(*git.Repository), params["repo_name"].(string), params["group_path"].([]string)
+
+	if strings.Contains(repo_name, "\n") || slice_contains_newline(group_path) {
+		notes = append(notes, "Path contains newlines; HTTP Git access impossible")
+	}
 
 	ref_hash, err = get_ref_hash_from_type_and_name(repo, params["ref_type"].(string), params["ref_name"].(string))
 	if err != nil {
@@ -48,6 +54,7 @@ no_ref:
 
 	params["http_clone_url"] = generate_http_remote_url(group_path, repo_name)
 	params["ssh_clone_url"] = generate_ssh_remote_url(group_path, repo_name)
+	params["notes"] = notes
 
 	render_template(w, "repo_index", params)
 }
diff --git a/static/style.css b/static/style.css
index 0c902d54ea0e70e6cdee93277d8cde63f1e1a9d9..511f941f2ba2c5e89a77b3b6b9885cf635280519 100644
--- a/static/style.css
+++ b/static/style.css
@@ -355,6 +355,14 @@ header#main-header > div#main-header-user {
 	display: flex;
 	align-items: center;
 }
+
+/* Uncategorized */
 table + table {
 	margin-top: 1rem;
 }
+
+td > ul {
+	padding-left: 1.5rem;
+	margin-top: 0;
+	margin-bottom: 0;
+}
diff --git a/templates/repo_index.tmpl b/templates/repo_index.tmpl
index da67df4846bb13adf9284b7f988c2470f47d1d4d..c9d7311074e2dc4515315cf42a3f8ca4538b20c1 100644
--- a/templates/repo_index.tmpl
+++ b/templates/repo_index.tmpl
@@ -33,6 +33,12 @@ 					<tr>
 						<th scope="row">SSH remote</th>
 						<td><code>{{ .ssh_clone_url }}</code></td>
 					</tr>
+					{{ if .notes }}
+						<tr>
+							<th scope="row">Notes</th>
+							<td><ul>{{ range .notes }}<li>{{ . }}</li>{{ end }}</ul></td>
+						</tr>
+					{{ end }}
 				</tbody>
 			</table>
 		</div>
diff --git a/utils.go b/utils.go
new file mode 100644
index 0000000000000000000000000000000000000000..f0b352df78f0dd012b91575f2fa57b83255676cf
--- /dev/null
+++ b/utils.go
@@ -0,0 +1,15 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// SPDX-FileContributor: Runxi Yu <https://runxiyu.org>
+
+package main
+
+import "strings"
+
+func slice_contains_newline(s []string) bool {
+	for _, v := range s {
+		if strings.Contains(v, "\n") {
+			return true
+		}
+	}
+	return false
+}

-- 
2.48.1