Gitea-John71/Gitea
2
0
Fork 0
mirror of https://github.com/go-gitea/gitea.git synced 2026-08-24 11:09:48 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(packages): bound Alpine metadata entries (#39026)

Browse Source
This commit is contained in:
bircni
2026-08-22 01:17:04 +02:00
committed by GitHub
parent ad05aaee80
commit 2b81cbbe70
2 changed files with 22 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
modules/packages/alpine/metadata.go
+12 -3
View File
@@ -18,9 +18,10 @@ import (
)
var (
ErrMissingPKGINFOFile = util.NewInvalidArgumentErrorf("PKGINFO file is missing")
ErrInvalidName = util.NewInvalidArgumentErrorf("package name is invalid")
ErrInvalidVersion = util.NewInvalidArgumentErrorf("package version is invalid")
ErrMissingPKGINFOFile = util.NewInvalidArgumentErrorf("PKGINFO file is missing")
ErrInvalidName = util.NewInvalidArgumentErrorf("package name is invalid")
ErrInvalidVersion = util.NewInvalidArgumentErrorf("package version is invalid")
ErrPackageInfoTooLarge = util.NewInvalidArgumentErrorf("PKGINFO contains too many entries")
)
const (
@@ -36,6 +37,8 @@ const (
RepositoryVersion = "_repository"
NoArch = "noarch"
maxPackageInfoEntries = 1024
)
// https://wiki.alpinelinux.org/wiki/Apk_spec
@@ -185,10 +188,16 @@ func ParsePackageInfo(r io.Reader) (*Package, error) {
p.FileMetadata.InstallIf = value
case "provides":
if value != "" {
if len(p.FileMetadata.Provides)+len(p.FileMetadata.Dependencies) >= maxPackageInfoEntries {
return nil, ErrPackageInfoTooLarge
}
p.FileMetadata.Provides = append(p.FileMetadata.Provides, value)
}
case "depend":
if value != "" {
if len(p.FileMetadata.Provides)+len(p.FileMetadata.Dependencies) >= maxPackageInfoEntries {
return nil, ErrPackageInfoTooLarge
}
p.FileMetadata.Dependencies = append(p.FileMetadata.Dependencies, value)
}
case "provider_priority":