GeezerVison

Problem

This was brought to our attention via a HackerOne report.

src serve-git accepted regular files as repository targets. Git can interpret a regular file containing a gitdir: pointer and follow it outside the configured serve root, which could expose a private repository.

Solution

Require smart HTTP repository targets to be directories before invoking Git. Return a not-found response for regular files, including gitdir: pointer files.

Add a regression test that confirms Git accepts the pointer file directly but src serve-git rejects the same file over HTTP.

Verification Evidence

• go test ./internal/servegit -count=1
• go test ./cmd/src -run '^$'