Subject: gitweb bug report: hash mistaken for an option

From: Nicolas George <[email-masked]>
Date: Wed, 18 Mar 2026 21:22:49 +0100

Hi.

We have a web server with gitweb (from Debian), and we observed git error
messages in apache's error.log. I tracked down the issue to a request that
had this:

```
?p=…/.git;a=tree;hb=-c
```

I will not bother giving the actual URL since nobody else can check the
issue in the logs or our server, but the issue can be reproduced on any
server by replacing the `hb=…` parameter with `hb=-c`.

I tracked down the issue further to the `git_tree` function of the CGI
script:

<https://git.kernel.org/pub/scm/git/git.git/tree/gitweb/gitweb.perl#n7200>

If `$hash_base`, i.e. the `hb` parameter, is set and not `$file_name`, then
it is passed as is as the last argument of `ls-tree -z`, and since it is not
a valid hash, it prints an error.

Since no shell gets invoked and the options of `ls-tree` are very limited, I
do not think it counts as a security flaw. But it could become one, so
better fix it.

I see really two issues:

First, that the parameter is interpreted as an option. It could become a
more severe issue if new options get introduced. And it is very easy to fix:
add a double dash.

Second, that the error (be it “unknown switch”, “Not a valid object name” or
“not a tree object” gets written into the error log: it is an error entirely
caused by the client that has no repercussion on the server, it should be
either passed back to the client or ignored. This is more minor but harder
to fix.

It might also be a good idea to check the rest of the source code for
similar patterns.

Thanks.

Regards,

-- 
  Nicolas George

[System Info]
git version:
git version 2.39.5
cpu: x86_64
no commit associated with this build
sizeof-long: 8
sizeof-size_t: 8
shell-path: /bin/sh
uname: Linux 6.1.0-44-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.1.164-1 (2026-03-09) x86_64
compiler info: gnuc: 12.2
libc info: glibc: 2.36
$SHELL (typically, interactive shell): /bin/zsh

[Enabled Hooks]
not run from a git repository - no hooks to show
>From a52031aac02bc0704a56d8ca36ba3ee6d25d5b11 Mon Sep 17 00:00:00 2001
From: Nicolas George <[email-masked]>
Date: Wed, 18 Mar 2026 21:11:57 +0100
Subject: [PATCH] gitweb: avoid hash being mistaken for an option

Fix (partially) weird warning in the error log of the server,
and potentially more severe issues if new options are added.

Signed-off-by: Nicolas George <[email-masked]>
---
 gitweb/gitweb.perl | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/gitweb/gitweb.perl b/gitweb/gitweb.perl
index fde804593b..2e131bcbe9 100755
--- a/gitweb/gitweb.perl
+++ b/gitweb/gitweb.perl
@@ -7217,7 +7217,7 @@ sub git_tree {
 	{
 		local $/ = "\0";
 		open my $fd, "-|", git_cmd(), "ls-tree", '-z',
-			($show_sizes ? '-l' : ()), @extra_options, $hash
+			($show_sizes ? '-l' : ()), @extra_options, "--", $hash
 			or die_error(500, "Open git-ls-tree failed");
 		@entries = map { chomp; $_ } <$fd>;
 		close $fd
-- 
2.51.0