From: "Derrick Stolee via GitGitGadget" <gitgitgadget@gmail.com>
To: git@vger.kernel.org
Cc: gitster@pobox.com, me@ttaylorr.com, newren@gmail.com,
"Ævar Arnfjörð Bjarmason" <avarab@gmail.com>,
"Teng Long" <dyroneteng@gmail.com>,
"Johannes Schindelin" <Johannes.Schindelin@gmx.de>,
"Derrick Stolee" <derrickstolee@github.com>,
"Derrick Stolee" <derrickstolee@github.com>
Subject: [PATCH 13/24] bundle-uri: limit recursion depth for bundle lists
Date: Fri, 20 May 2022 18:40:31 +0000 [thread overview]
Message-ID: <00dc67f5188b107d5ddaf8b32f03fa61f515a5ec.1653072042.git.gitgitgadget@gmail.com> (raw)
In-Reply-To: <pull.1234.git.1653072042.gitgitgadget@gmail.com>
From: Derrick Stolee <derrickstolee@github.com>
The next change will start allowing us to parse bundle lists that are
downloaded from a provided bundle URI. Those lists might point to other
lists, which could proceed to an arbitrary depth (and even create
cycles). Restructure fetch_bundle_uri() to have an internal version that
has a recursion depth. Compare that to a new max_bundle_uri_depth
constant that is twice as high as we expect this depth to be for any
legitimate use of bundle list linking.
We can consider making max_bundle_uri_depth a configurable value if
there is demonstrated value in the future.
Signed-off-by: Derrick Stolee <derrickstolee@github.com>
---
bundle-uri.c | 21 ++++++++++++++++++++-
1 file changed, 20 insertions(+), 1 deletion(-)
diff --git a/bundle-uri.c b/bundle-uri.c
index ff215422888..74a26ce6c00 100644
--- a/bundle-uri.c
+++ b/bundle-uri.c
@@ -308,11 +308,25 @@ static int unbundle_from_file(struct repository *r, const char *file)
return result;
}
-int fetch_bundle_uri(struct repository *r, const char *uri)
+/**
+ * This limits the recursion on fetch_bundle_uri_internal() when following
+ * bundle lists.
+ */
+static int max_bundle_uri_depth = 4;
+
+static int fetch_bundle_uri_internal(struct repository *r,
+ const char *uri,
+ int depth)
{
int result = 0;
struct strbuf filename = STRBUF_INIT;
+ if (depth >= max_bundle_uri_depth) {
+ warning(_("exceeded bundle URI recursion limit (%d)"),
+ max_bundle_uri_depth);
+ return -1;
+ }
+
find_temp_filename(&filename);
if ((result = copy_uri_to_file(uri, filename.buf)))
goto cleanup;
@@ -335,6 +349,11 @@ cleanup:
return result;
}
+int fetch_bundle_uri(struct repository *r, const char *uri)
+{
+ return fetch_bundle_uri_internal(r, uri, 0);
+}
+
/**
* General API for {transport,connect}.c etc.
*/
--
gitgitgadget
next prev parent reply other threads:[~2022-05-20 18:42 UTC|newest]
Thread overview: 25+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-05-20 18:40 [PATCH 00/24] [RFC] Bundle URIs Combined RFC Derrick Stolee via GitGitGadget
2022-05-20 18:40 ` [PATCH 01/24] docs: document bundle URI standard Derrick Stolee via GitGitGadget
2022-05-20 18:40 ` [PATCH 02/24] remote-curl: add 'get' capability Derrick Stolee via GitGitGadget
2022-05-20 18:40 ` [PATCH 03/24] bundle-uri: create basic file-copy logic Derrick Stolee via GitGitGadget
2022-05-20 18:40 ` [PATCH 04/24] bundle-uri: add support for http(s):// and file:// Derrick Stolee via GitGitGadget
2022-05-20 18:40 ` [PATCH 05/24] fetch: add --bundle-uri option Derrick Stolee via GitGitGadget
2022-05-20 18:40 ` [PATCH 06/24] fetch: add 'refs/bundle/' to log.excludeDecoration Derrick Stolee via GitGitGadget
2022-05-20 18:40 ` [PATCH 07/24] clone: add --bundle-uri option Derrick Stolee via GitGitGadget
2022-05-20 18:40 ` [PATCH 08/24] clone: --bundle-uri cannot be combined with --depth Derrick Stolee via GitGitGadget
2022-05-20 18:40 ` [PATCH 09/24] bundle-uri: create bundle_list struct and helpers Derrick Stolee via GitGitGadget
2022-05-20 18:40 ` [PATCH 10/24] bundle-uri: create base key-value pair parsing Derrick Stolee via GitGitGadget
2022-05-20 18:40 ` [PATCH 11/24] bundle-uri: create "key=value" line parsing Ævar Arnfjörð Bjarmason via GitGitGadget
2022-05-20 18:40 ` [PATCH 12/24] bundle-uri: unit test "key=value" parsing Ævar Arnfjörð Bjarmason via GitGitGadget
2022-05-20 18:40 ` Derrick Stolee via GitGitGadget [this message]
2022-05-20 18:40 ` [PATCH 14/24] bundle-uri: parse bundle list in config format Derrick Stolee via GitGitGadget
2022-05-20 18:40 ` [PATCH 15/24] bundle-uri: fetch a list of bundles Derrick Stolee via GitGitGadget
2022-05-20 18:40 ` [PATCH 16/24] protocol v2: add server-side "bundle-uri" skeleton Ævar Arnfjörð Bjarmason via GitGitGadget
2022-05-20 18:40 ` [PATCH 17/24] bundle-uri client: add minimal NOOP client Ævar Arnfjörð Bjarmason via GitGitGadget
2022-05-20 18:40 ` [PATCH 18/24] bundle-uri client: add "git ls-remote-bundle-uri" Ævar Arnfjörð Bjarmason via GitGitGadget
2022-05-20 18:40 ` [PATCH 19/24] bundle-uri: serve URI advertisement from bundle.* config Derrick Stolee via GitGitGadget
2022-05-20 18:40 ` [PATCH 20/24] bundle-uri client: add boolean transfer.bundleURI setting Ævar Arnfjörð Bjarmason via GitGitGadget
2022-05-20 18:40 ` [PATCH 21/24] bundle-uri: allow relative URLs in bundle lists Derrick Stolee via GitGitGadget
2022-05-20 18:40 ` [PATCH 22/24] bundle-uri: download bundles from an advertised list Derrick Stolee via GitGitGadget
2022-05-20 18:40 ` [PATCH 23/24] clone: unbundle the advertised bundles Derrick Stolee via GitGitGadget
2022-05-20 18:40 ` [PATCH 24/24] t5601: basic bundle URI tests Derrick Stolee via GitGitGadget
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
List information: http://vger.kernel.org/majordomo-info.html
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=00dc67f5188b107d5ddaf8b32f03fa61f515a5ec.1653072042.git.gitgitgadget@gmail.com \
--to=gitgitgadget@gmail.com \
--cc=Johannes.Schindelin@gmx.de \
--cc=avarab@gmail.com \
--cc=derrickstolee@github.com \
--cc=dyroneteng@gmail.com \
--cc=git@vger.kernel.org \
--cc=gitster@pobox.com \
--cc=me@ttaylorr.com \
--cc=newren@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
Code repositories for project(s) associated with this public inbox
https://80x24.org/mirrors/git.git
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).