url: do not allow %00 to represent NUL in URLs
There is no reason to allow %00 to terminate a string, so do not allow it. Otherwise, we end up returning arbitrary content in the string (that which is after the %00) which is effectively hidden from callers and can escape sanity checks and validation, and possible be used in tandem with a security vulnerability to introduce a payload. Helped-by: Nbrian m. carlson <sandals@crustytoothpaste.net> Signed-off-by: NMatthew DeVore <matvore@google.com> Signed-off-by: NJunio C Hamano <gitster@pobox.com>
Showing
想要评论请 注册 或 登录