Comments (8)
DEMON1A
commented on August 14, 2024
1
Yeah I already edited that line of code before. but the issue was still there. then i noticed there's a second layer of validation on line 73 do the same thing as 33. edited it and now it's working for me.
from git-dumper.
DashLt
commented on August 14, 2024
1
Not every site has a <html> tag verbatim. Many have attributes inside the tag, e.g.:
<html class="rwd geo-override no-js vis no-rtl headerfooter-menu3 " lang="en">
It's weird that whatever webserver in the site you're attacking isn't using the application/octet-stream content-type, but it exists so it's definitely an edge case that has to be handled. As a quick and dirty thing you could check for the existence of <html, but even then that tag isn't necessarily required. I think maybe some sort of HEAD file validation is in order?
from git-dumper.
arthaud
commented on August 14, 2024
I think originally I was only checking whether the content contains "" but people had issues with that, see #13
@DashLt do you know what was the issue with the original check?
In the meantime you can replace line 33 of git_dumper.py with a return False.
from git-dumper.
arthaud
commented on August 14, 2024
That's also my conclusion. We would need a reference syntax checker. or we could just skip the verification on that file and fail later when we parse objects file (which need to be compressed with zlib, so that rules out html).
from git-dumper.
DEMON1A
commented on August 14, 2024
Not every site has a tag verbatim. Many have attributes inside the tag, e.g.:
You can solve this with regex, Pattern: \<html(|.*)\>
from git-dumper.
DEMON1A
commented on August 14, 2024
If you gonna accept the RE solution, I can do the fixes on PR if you would like.
from git-dumper.
DashLt
commented on August 14, 2024
You can solve this with regex, Pattern:
\<html(|.*)\>
https://stackoverflow.com/a/1732454
(In all seriousness, running a regex that matches that much could cause serious slowdowns on pages that can easily reach the hundreds of KB or even MB. You would also be able to send git-dumper back a very large page and make it hang as well. It's in general just a very hacky solution.)
from git-dumper.
DEMON1A
commented on August 14, 2024
You seems to be right, but I guess in this case we don't really need that HTML content-type validation if we already know that it contains a content from the GIT folder. for example checking a string on /.git/config will be more than fine to keep fetching other stuff without caring about content-type.
from git-dumper.
Related Issues (20)
- ModuleNotFoundError: No module named 'dulwich'
- Add headers when retrieving files from server
- Bit Bucket support? HOT 3
- [Chore] setup.py HOT 1
- git-dumper naming error HOT 1
- AttributeError: 'Index' object has no attribute 'iterblobs' HOT 6
- OSError: [WinError 123] The filename, directory name, or volume label syntax is incorrect: 'XX.XX.XX.XXX\r' HOT 1
- struct.error: unpack requires a buffer of 8 bytes HOT 6
- AttributeError: 'Index' object has no attribute 'iterblobs' HOT 1
- Authorization header ? HOT 2
- Git dumper doesnt work on mac m1 HOT 1
- unable to install HOT 2
- Information about the disclaimer HOT 2
- Security risk - RCE in `.git/config` HOT 1
- add support for authencated proxy
- Dorks HOT 1
- Stuck at last while downloading Objects
- infinite loop when error 301 on info/objects/pack HOT 1
- Recursive download incorrectly includes ../ HOT 4
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from git-dumper.