Gitea-John71/Gitea
2
0
Fork 0
mirror of https://github.com/go-gitea/gitea.git synced 2026-08-24 03:00:00 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(packages): limit Swift package manifests (#39025) (#39032)

Browse Source 
Backport #39025 by @bircni

Bound the number and aggregate size of Swift manifests retained from an
uploaded archive.

Co-authored-by: bircni <bircni@icloud.com>
This commit is contained in:
Giteabot
2026-08-22 01:22:39 -07:00
committed by GitHub
parent 1350cf8a38
commit 9fe8653e45
2 changed files with 27 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
modules/packages/swift/metadata.go
+13
View File
@@ -21,6 +21,7 @@ import (
var (
ErrMissingManifestFile = util.NewInvalidArgumentErrorf("Package.swift file is missing")
ErrManifestFileTooLarge = util.NewInvalidArgumentErrorf("Package.swift file is too large")
ErrManifestFilesTooLarge = util.NewInvalidArgumentErrorf("Package.swift files are too large")
ErrInvalidManifestVersion = util.NewInvalidArgumentErrorf("manifest version is invalid")
manifestPattern = regexp.MustCompile(`\APackage(?:@swift-(\d+(?:\.\d+)?(?:\.\d+)?))?\.swift\z`)
@@ -29,6 +30,8 @@ var (
const (
maxManifestFileSize = 128 * 1024
maxManifestFiles = 64
maxManifestSize = maxManifestFiles * maxManifestFileSize
PropertyScope = "swift.scope"
PropertyName = "swift.name"
@@ -140,6 +143,16 @@ func ParsePackage(sr io.ReaderAt, size int64, mr io.Reader) (*Package, error) {
manifestFiles = append(manifestFiles, file)
}
}
if len(manifestFiles) > maxManifestFiles {
return nil, ErrManifestFilesTooLarge
}
var manifestSize uint64
for _, file := range manifestFiles {
manifestSize += file.UncompressedSize64
}
if manifestSize > maxManifestSize {
return nil, ErrManifestFilesTooLarge
}
for _, file := range manifestFiles {
manifestMatch := manifestPattern.FindStringSubmatch(path.Base(file.Name))