M routes/git.go

@@ -8,13 +8,19 @@ "net/http"
 	"path/filepath"
 
 	"git.icyphox.sh/legit/git/service"
+	securejoin "github.com/cyphar/filepath-securejoin"
 )
 
 func (d *deps) InfoRefs(w http.ResponseWriter, r *http.Request) {
 	name := r.PathValue("name")
 	name = filepath.Clean(name)
 

… preview truncated

M routes/routes.go

@@ -15,6 +15,7 @@ "time"
 
 	"git.icyphox.sh/legit/config"
 	"git.icyphox.sh/legit/git"
+	securejoin "github.com/cyphar/filepath-securejoin"
 	"github.com/dustin/go-humanize"
 	"github.com/microcosm-cc/bluemonday"
 	"github.com/russross/blackfriday/v2"
@@ -45,7 +46,13 @@ if !dir.IsDir() || d.isIgnored(name) || d.isUnlisted(name) {
 			continue
 		}
 

… preview truncated