server/user-create: Disallow single and double quotes in SSH key

leonklingele · May 18, 2018 · 2d3ab5d · 2d3ab5d
1 parent 67029aa
commit 2d3ab5d
Showing 1 changed file with 5 additions and 0 deletions.
diff --git a/server/git-shell-commands/user-create b/server/git-shell-commands/user-create
@@ -34,6 +34,11 @@ if [ -z "$PUBLIC_KEY" ]; then
 	exit 1
 fi
 
+if (echo "$PUBLIC_KEY" | grep -xPq '^.*(\047|\042).*$'); then
+	echo 'Disallowed characters in public key. Disallowed: '"'"', "'
+	exit 1
+fi
+
 # TODO(leon): Do we want to validate ssh-key type (e.g. rsa / ed25519 / ..)?
 case "$PUBLIC_KEY" in
 'ssh-'*)