mirror of
https://github.com/go-gitea/gitea.git
synced 2026-08-08 22:50:33 +00:00
Giteabot
cca0c65a6c
Backport #38102 by @metsw24-max The arch parser keeps tar member names verbatim. The index writer joins those values one per line into the pacman database. So a member name with a newline adds lines to that package's own `files` entry, which libalpm reads as further fields. The scope is one package record. An uploader cannot forge entries for another package, and can set the same fields in `.PKGINFO` anyway. This is input validation, not a privilege boundary. `ParsePackage` now drops names that contain CR or LF. `joinFields` drops such values again when writing the index, which also covers packages that are already stored. Real packages never carry newlines in file paths, so well-formed uploads are unaffected. Co-authored-by: metsw24-max <metsw24@gmail.com> Co-authored-by: silverwind <me@silverwind.io>