Gitea-John71/Gitea
2
0
Fork 0
mirror of https://github.com/go-gitea/gitea.git synced 2026-08-24 03:00:00 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(packages): limit Swift package manifests (#39025) (#39032)

Browse Source 
Backport #39025 by @bircni

Bound the number and aggregate size of Swift manifests retained from an
uploaded archive.

Co-authored-by: bircni <bircni@icloud.com>
This commit is contained in:
Giteabot
2026-08-22 01:22:39 -07:00
committed by GitHub
parent 1350cf8a38
commit 9fe8653e45
2 changed files with 27 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
modules/packages/swift/metadata_test.go
+14
View File
@@ -6,6 +6,7 @@ package swift
import (
"archive/zip"
"bytes"
"fmt"
"strings"
"testing"
@@ -54,6 +55,19 @@ func TestParsePackage(t *testing.T) {
assert.ErrorIs(t, err, ErrManifestFileTooLarge)
})
t.Run("TooManyManifestFiles", func(t *testing.T) {
entries := make([][2]string, 0, maxManifestFiles+1)
entries = append(entries, [2]string{"Package.swift", "// swift-tools-version:5.7"})
for i := range maxManifestFiles {
entries = append(entries, [2]string{fmt.Sprintf("Package@swift-5.%d.swift", i), "// swift-tools-version:5.7"})
}
data := writeOrderedZipArchive(entries)
p, err := ParsePackage(bytes.NewReader(data.Bytes()), int64(data.Len()), nil)
assert.Nil(t, p)
assert.ErrorIs(t, err, ErrManifestFilesTooLarge)
})
t.Run("WithoutMetadata", func(t *testing.T) {
content1 := "// swift-tools-version:5.7\n//\n// Package.swift"
content2 := "// swift-tools-version:5.6\n//\n// Package@swift-5.6.swift"