[BUG] `git instaweb` and `gitweb`
From: windwiny <hidden>
Date: 2025-11-24 13:04:54
Hi,
When i run `git instaweb` on a code dir, it generate .git/gitweb/ dir
and some .conf/.perl files,
and lighttpd+fastcgi read/exec those files to serve git repo access via http.
When dir name include `@` char ,then instaweb run ok, but gitweb.cgi
will get incorrect dir name.
In Perl, the array variable @xx is interpolated (its value is
inserted into the string) inside a "" (double-quoted) string, but not
inside a '' (single-quoted) string.
i write a simple patch can fix when dir include `@` char.
--- git-instaweb.ori Tue Sep 30 05:50:42 2025
+++ git-instaweb Mon Nov 24 20:53:13 2025
@@ -716,10 +716,10 @@
gitweb_conf() {
cat > "$fqgitdir/gitweb/gitweb_config.perl" <<EOF
#!/usr/bin/perl
-our \$projectroot = "$(dirname "$fqgitdir")";
-our \$git_temp = "$fqgitdir/gitweb/tmp";
+our \$projectroot = '$(dirname "$fqgitdir")';
+our \$git_temp = '$fqgitdir/gitweb/tmp';
our \$projects_list = \$projectroot;
\$feature{'remote_heads'}{'default'} = [1];
EOF
Than fixed, those code still has bug: if dir name include `'` or `"`,
instaweb run failed.
OTHER, the instaweb generated an .perl script, gitweb exec it to read
vars define,
this method may cause CVE security vulnerability issues.
Probably should replaced by .ini/.conf/.json