improve ssh command parsing

check for and forbid .. and empty basename

simplify

1 files changed, 5 insertions, 5 deletions

diff --git a/src/endofossil b/src/endofossil
index dd86bb3..382dde5 100644
--- a/src/endofossil
+++ b/src/endofossil
@@ -28,13 +28,13 @@ case "$SSH_ORIGINAL_COMMAND" in
     fossil\ test-http\ * )
         set -- $SSH_ORIGINAL_COMMAND
         [ $# = 3 ]
-        f=/${3%$require_extension}$require_extension
+        case "$3" in */../* | ../* | */.. ) exit 1 ;; esac
         for d in "${shared_paths[@]}"
         do
-            relativePart=${d#*/./}
-            absolutePart=${d%$relativePart}
-            tryPath=$absolutePart$relativePart${f#/$relativePart}
-            if upstreamDatabase=$(realpath -e -s "$tryPath")
+            f=${3#/${d##*/./}}
+            f=${f%$require_extension}$require_extension
+            [ "$f" != "$require_extension" ]
+            if upstreamDatabase=$(realpath -e -s "$d"/"$f")
             then
                 break
             fi