From ab11453fc8d4d1e8eb9c8cd57e8469a1f1a5fcb9 Mon Sep 17 00:00:00 2001
From: Jose Diaz-Gonzalez <email@josediazgonzalez.com>
Date: Sat, 19 Aug 2017 19:16:40 -0400
Subject: [PATCH] feat: validate app name when running git functions

---
 plugins/git/functions     | 6 +++++-
 tests/unit/40_core_2.bats | 7 +++++++
 2 files changed, 12 insertions(+), 1 deletion(-)

diff --git a/plugins/git/functions b/plugins/git/functions
index 40d5cac2d..d5a972c70 100755
--- a/plugins/git/functions
+++ b/plugins/git/functions
@@ -105,8 +105,10 @@ git_hook_cmd() {
   declare desc="kick off receive-app trigger from git prereceive hook"
   local cmd="git-hook"
   local APP="$2"  
-  local DOKKU_DEPLOY_BRANCH="$(git_deploy_branch "$APP")"
+  local DOKKU_DEPLOY_BRANCH
+  is_valid_app_name "$APP"
 
+  DOKKU_DEPLOY_BRANCH="$(git_deploy_branch "$APP")"
   if ! git check-ref-format --branch "$DOKKU_DEPLOY_BRANCH" > /dev/null 2>&1; then
     echo $'\e[1G\e[K'"-----> WARNING: Invalid branch name '$DOKKU_DEPLOY_BRANCH' specified via DOKKU_DEPLOY_BRANCH."
     echo $'\e[1G\e[K'"-----> For more details, please see the man page for 'git-check-ref-format.'"
@@ -150,6 +152,7 @@ git_upload_pack_cmd() {
   declare desc="executes git-upload-pack"
   local cmd="git-upload-pack"
   local APP="$(echo "$2" | perl -pe 's/(?<!\\)'\''//g' | sed 's/\\'\''/'\''/g')"
+  is_valid_app_name "$APP"
   plugn trigger git-pre-pull "$APP"
   cat | git-upload-pack "$DOKKU_ROOT/$APP"
   plugn trigger git-post-pull "$APP"
@@ -160,6 +163,7 @@ git_glob_cmd() {
   local cmd="git-*"
   local APP="$(echo "$2" | perl -pe 's/(?<!\\)'\''//g' | sed 's/\\'\''/'\''/g' | sed 's/^\///g')"
   local APP_PATH=$DOKKU_ROOT/$APP
+  is_valid_app_name "$APP"
 
   if [[ $1 == "git-receive-pack" && ! -d "$APP_PATH/refs" ]]; then
     git init --bare "$APP_PATH" > /dev/null
diff --git a/tests/unit/40_core_2.bats b/tests/unit/40_core_2.bats
index 479b02213..c9f6ed581 100644
--- a/tests/unit/40_core_2.bats
+++ b/tests/unit/40_core_2.bats
@@ -97,3 +97,10 @@ build_nginx_config() {
   echo "status: "$status
   assert_success
 }
+
+@test "(core) git-remote (bad name)" {
+  run deploy_app nodejs-express ssh://dokku@127.0.0.1:22333/home/dokku/$TEST_APP
+  echo "output: "$output
+  echo "status: "$status
+  assert_failure
+}