ynkmr/gitea
1
0
Fork 0
mirror of https://github.com/go-gitea/gitea.git synced 2026-09-08 14:03:24 +09:00
Code Issues Projects Releases Wiki Activity

fix(packages): limit Swift package manifests (#39025)

Browse Source 
Bound the number and aggregate size of Swift manifests retained from an
uploaded archive.
This commit is contained in:
bircni
2026-08-22 00:11:29 +00:00
committed by GitHub
parent fa4c0b1cf6
commit aa96725ae7
2 changed files with 27 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
modules/packages/swift/metadata_test.go
+14
View File
@@ -6,6 +6,7 @@ package swift
import (
"archive/zip"
"bytes"
"fmt"
"strings"
"testing"
@@ -54,6 +55,19 @@ func TestParsePackage(t *testing.T) {
assert.ErrorIs(t, err, ErrManifestFileTooLarge)
})
t.Run("TooManyManifestFiles", func(t *testing.T) {
entries := make([][2]string, 0, maxManifestFiles+1)
entries = append(entries, [2]string{"Package.swift", "// swift-tools-version:5.7"})
for i := range maxManifestFiles {
entries = append(entries, [2]string{fmt.Sprintf("Package@swift-5.%d.swift", i), "// swift-tools-version:5.7"})
}
data := writeOrderedZipArchive(entries)
p, err := ParsePackage(bytes.NewReader(data.Bytes()), int64(data.Len()), nil)
assert.Nil(t, p)
assert.ErrorIs(t, err, ErrManifestFilesTooLarge)
})
t.Run("WithoutMetadata", func(t *testing.T) {
content1 := "// swift-tools-version:5.7\n//\n// Package.swift"
content2 := "// swift-tools-version:5.6\n//\n// Package@swift-5.6.swift"