Fix FindCommits flag injection exploit

1 files changed, 13 insertions, 3 deletions

diff --git a/internal/git/proto.go b/internal/git/proto.go
index 5244e6bdb..17323c600 100644
--- a/internal/git/proto.go
+++ b/internal/git/proto.go
@@ -18,9 +18,8 @@ import (
 // See https://gitlab.com/gitlab-org/gitaly/issues/556#note_40289573
 var FallbackTimeValue = time.Unix(1<<63-62135596801, 999999999)
 
-// ValidateRevision checks if a revision looks valid
-func ValidateRevision(revision []byte) error {
-	if len(revision) == 0 {
+func validateRevision(revision []byte, allowEmpty bool) error {
+	if !allowEmpty && len(revision) == 0 {
 		return fmt.Errorf("empty revision")
 	}
 	if bytes.HasPrefix(revision, []byte("-")) {
@@ -38,6 +37,17 @@ func ValidateRevision(revision []byte) error {
 	return nil
 }
 
+// ValidateRevisionAllowEmpty checks if a revision looks valid, but allows
+// empty strings
+func ValidateRevisionAllowEmpty(revision []byte) error {
+	return validateRevision(revision, true)
+}
+
+// ValidateRevision checks if a revision looks valid
+func ValidateRevision(revision []byte) error {
+	return validateRevision(revision, false)
+}
+
 // Version returns the used git version.
 func Version() (string, error) {
 	ctx, cancel := context.WithCancel(context.Background())