fix(packages): validate debian distribution and component names (#38116)

**Newline injection into the Debian Release and Packages indices**

The `distribution` and `component` come straight from the request path
and are written line by line into the generated `Release` and `Packages`
files (the `Suite`/`Codename`/`Components` lines and the `Filename:
pool/<distribution>/<component>/...` line), but `UploadPackageFile` only
checked they were non-empty. `ctx.PathParam` url-decodes the segment, so
an encoded newline such as `main%0AInjected-Field: x` is accepted,
stored and then re-emitted for that distribution, which lets an
authenticated uploader forge extra fields in the index apt consumes.
Restricted both values to a conservative name pattern in the handler,
since that is the layer that accepts them; this should also keep the
pool paths well formed.

---------

Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>

modules/packages/debian/metadata.go

@@ -11,6 +11,7 @@ import (
 	"net/mail"
 	"regexp"
 	"strings"
+	"sync"
 
 	"gitea.dev/modules/util"
 	"gitea.dev/modules/validation"
@@ -36,18 +37,36 @@ const (
 	controlTar = "control.tar"
 )
 
-var (
-	ErrMissingControlFile     = util.NewInvalidArgumentErrorf("control file is missing")
-	ErrUnsupportedCompression = util.NewInvalidArgumentErrorf("unsupported compression algorithm")
-	ErrInvalidName            = util.NewInvalidArgumentErrorf("package name is invalid")
-	ErrInvalidVersion         = util.NewInvalidArgumentErrorf("package version is invalid")
-	ErrInvalidArchitecture    = util.NewInvalidArgumentErrorf("package architecture is invalid")
+var GlobalVars = sync.OnceValue(func() (ret struct {
+	ErrMissingControlFile     error
+	ErrUnsupportedCompression error
+	ErrInvalidName            error
+	ErrInvalidVersion         error
+	ErrInvalidArchitecture    error
+
+	namePattern    *regexp.Regexp
+	versionPattern *regexp.Regexp
+	symbolPattern  *regexp.Regexp
+},
+) {
+	ret.ErrMissingControlFile = util.NewInvalidArgumentErrorf("control file is missing")
+	ret.ErrUnsupportedCompression = util.NewInvalidArgumentErrorf("unsupported compression algorithm")
+	ret.ErrInvalidName = util.NewInvalidArgumentErrorf("package name is invalid")
+	ret.ErrInvalidVersion = util.NewInvalidArgumentErrorf("package version is invalid")
+	ret.ErrInvalidArchitecture = util.NewInvalidArgumentErrorf("package architecture is invalid")
 
 	// https://www.debian.org/doc/debian-policy/ch-controlfields.html#source
-	namePattern = regexp.MustCompile(`\A[a-z0-9][a-z0-9+-.]+\z`)
+	ret.namePattern = regexp.MustCompile(`\A[a-z0-9][a-z0-9+-.]+\z`)
 	// https://www.debian.org/doc/debian-policy/ch-controlfields.html#version
-	versionPattern = regexp.MustCompile(`\A(?:(0|[1-9][0-9]*):)?[a-zA-Z0-9.+~]+(?:-[a-zA-Z0-9.+-~]+)?\z`)
-)
+	ret.versionPattern = regexp.MustCompile(`\A(?:(0|[1-9][0-9]*):)?[a-zA-Z0-9.+~]+(?:-[a-zA-Z0-9.+-~]+)?\z`)
+
+	// distribution and component are taken from the request path and written
+	// verbatim into the generated line-based Release and Packages indices (and
+	// into the pool/<distribution>/<component> paths referenced from them), so
+	// they must be restricted to a character set that cannot break that format.
+	ret.symbolPattern = regexp.MustCompile(`\A[a-zA-Z0-9][a-zA-Z0-9.~+_-]*\z`)
+	return ret
+})
 
 type Package struct {
 	Name         string
@@ -64,6 +83,10 @@ type Metadata struct {
 	Dependencies []string `json:"dependencies,omitempty"`
 }
 
+func IsValidDistributionOrComponent(s string) bool {
+	return GlobalVars().symbolPattern.MatchString(s)
+}
+
 // ParsePackage parses the Debian package file
 // https://manpages.debian.org/bullseye/dpkg-dev/deb.5.en.html
 func ParsePackage(r io.Reader) (*Package, error) {
@@ -109,7 +132,7 @@ func ParsePackage(r io.Reader) (*Package, error) {
 
 				inner = zr
 			default:
-				return nil, ErrUnsupportedCompression
+				return nil, GlobalVars().ErrUnsupportedCompression
 			}
 
 			tr := tar.NewReader(inner)
@@ -133,7 +156,7 @@ func ParsePackage(r io.Reader) (*Package, error) {
 		}
 	}
 
-	return nil, ErrMissingControlFile
+	return nil, GlobalVars().ErrMissingControlFile
 }
 
 // ParseControlFile parses a Debian control file to retrieve the metadata
@@ -210,14 +233,14 @@ func ParseControlFile(r io.Reader) (*Package, error) {
 		return nil, err
 	}
 
-	if !namePattern.MatchString(p.Name) {
-		return nil, ErrInvalidName
+	if !GlobalVars().namePattern.MatchString(p.Name) {
+		return nil, GlobalVars().ErrInvalidName
 	}
-	if !versionPattern.MatchString(p.Version) {
-		return nil, ErrInvalidVersion
+	if !GlobalVars().versionPattern.MatchString(p.Version) {
+		return nil, GlobalVars().ErrInvalidVersion
 	}
 	if p.Architecture == "" {
-		return nil, ErrInvalidArchitecture
+		return nil, GlobalVars().ErrInvalidArchitecture
 	}
 
 	dependencies := strings.Split(depends.String(), ",")