| 1 | <?php |
| 2 | /************************************************************* |
| 3 | # 076 License |
| 4 | |
| 5 | Copyright (c) テクニカル諏訪子 |
| 6 | |
| 7 | Permission is hereby granted to any person obtaining a copy of the software |
| 8 | Little Beast (the "Software") to use, modify, merge, copy, publish, distribute, |
| 9 | sublicense, and/or sell copies of the Software, subject to the following conditions: |
| 10 | |
| 11 | 1. **Origin Attribution**: |
| 12 | - You must not misrepresent the origin of the Software; you must not claim |
| 13 | you created the original Software. |
| 14 | - If the Software is used in a product, you must either: |
| 15 | a. Provide clear attribution in the product's documentation, user interface, |
| 16 | or other visible areas, **OR** |
| 17 | b. Pay the original developers a fee they specify in writing. |
| 18 | 2. **Usage Restriction**: |
| 19 | - The Software, or any derivative works, dependencies, or libraries |
| 20 | incorporating it, must not be used for censorship or to suppress freedom of |
| 21 | speech, expression, or creativity. Prohibited uses include, but are not |
| 22 | limited to: |
| 23 | - Censorship of so-called "hate speech", visuals, non-mainstream opinions, |
| 24 | ideas, or objective reality. |
| 25 | - Tools or systems designed to restrict access to information or |
| 26 | artistic works. |
| 27 | 3. **Notice Preservation**: |
| 28 | - This license and the above copyright notice must remain intact in all copies |
| 29 | of the source code. |
| 30 | |
| 31 | THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, |
| 32 | INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A |
| 33 | PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT |
| 34 | HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF |
| 35 | CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE |
| 36 | OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. |
| 37 | */ |
| 38 | namespace Std\Lib\Git; |
| 39 | |
| 40 | /** |
| 41 | * SSH（git clone git@host:user/repo.git、git push） |
| 42 | * |
| 43 | * sshdのauthorized_keysのcommand=から呼ぶスクリプトで使う。SSH_ORIGINAL_COMMANDは |
| 44 | * 「git-upload-pack 'user/repo.git'」又は「git-receive-pack 'user/repo.git'」。 |
| 45 | * プロトコルv2はGIT_PROTOCOL（sshd_configのAcceptEnv GIT_PROTOCOLが必要）。 |
| 46 | */ |
| 47 | final class Ssh { |
| 48 | /** |
| 49 | * コマンドを解析する |
| 50 | * |
| 51 | * @return array|null [サービス（git-upload-pack又はgit-receive-pack）, パス] |
| 52 | */ |
| 53 | public static function parse(string $command): ?array { |
| 54 | if (!preg_match('/^(git[ -](?:upload-pack|receive-pack|upload-archive))\s+(.+)$/s', trim($command), $m)) return null; |
| 55 | $service = str_replace('git ', 'git-', $m[1]); |
| 56 | $arg = trim($m[2]); |
| 57 | // シェルの引用符（'…'、'\''） |
| 58 | if (str_starts_with($arg, "'")) { |
| 59 | if (!preg_match("/^'((?:[^']|'\\\\'')*)'$/s", $arg, $q)) return null; |
| 60 | $arg = str_replace("'\\''", "'", $q[1]); |
| 61 | } else if (str_starts_with($arg, '"')) { |
| 62 | $arg = trim($arg, '"'); |
| 63 | } |
| 64 | $path = preg_replace('#^(~/|/)+#', '', $arg); |
| 65 | if ($path === '' || str_contains($path, "\0") || preg_match('#(^|/)\.\.(/|$)#', $path)) return null; |
| 66 | return [$service, $path]; |
| 67 | } |
| 68 | |
| 69 | /** |
| 70 | * SSHのコマンドを処理する |
| 71 | * |
| 72 | * @param string $command SSH_ORIGINAL_COMMAND |
| 73 | * @param callable $open fn(string $path, bool $write): ?Repository（アクセスの確認。nullならリポジトリが無い・権限が無い） |
| 74 | * @param array $opt receive（ReceivePackのオプション）、agent |
| 75 | * @return int 終了コード |
| 76 | */ |
| 77 | public static function handle(string $command, callable $open, array $opt = [], $in = null, $out = null, $err = null): int { |
| 78 | $in ??= STDIN; |
| 79 | $out ??= STDOUT; |
| 80 | $err ??= STDERR; |
| 81 | $p = self::parse($command); |
| 82 | if ($p === null || $p[0] === 'git-upload-archive') { |
| 83 | fwrite($err, "このコマンドは使えません。\n"); |
| 84 | return 1; |
| 85 | } |
| 86 | [$service, $path] = $p; |
| 87 | $write = $service === 'git-receive-pack'; |
| 88 | try { |
| 89 | $repo = $open($path, $write); |
| 90 | } catch (GitException $e) { |
| 91 | $repo = null; |
| 92 | } |
| 93 | if (!$repo instanceof Repository) { |
| 94 | fwrite($err, "リポジトリ「{$path}」が有りません、又は".($write ? 'プッシュする' : '読む')."権限が有りません。\n"); |
| 95 | return 1; |
| 96 | } |
| 97 | $agent = ['agent' => (string)($opt['agent'] ?? 'LittleBeast')]; |
| 98 | try { |
| 99 | if ($write) { |
| 100 | (new ReceivePack($repo, $agent + ($opt['receive'] ?? [])))->serve($in, $out, false); |
| 101 | } else { |
| 102 | $version = str_contains((string)getenv('GIT_PROTOCOL'), 'version=2') ? 2 : 0; |
| 103 | (new UploadPack($repo, $agent))->serve($in, $out, false, $version); |
| 104 | } |
| 105 | } catch (GitException $e) { |
| 106 | fwrite($err, $e->getMessage()."\n"); |
| 107 | return 1; |
| 108 | } |
| 109 | return 0; |
| 110 | } |
| 111 | } |