[PATCH 13/24] bundle-uri: limit recursion depth for bundle lists
- From
Derrick Stolee via GitGitGadget <gitgitgadget@gmail.com>
- Date
- May 20, 2022, 18:40 UTC
- Message-ID
- <00dc67f5188b107d5ddaf8b32f03fa61f515a5ec.1653072042.git.gitgitgadget@gmail.com>
- In-Reply-To
- <pull.1234.git.1653072042.gitgitgadget@gmail.com>
From: Derrick Stolee <derrickstolee@github.com>
The next change will start allowing us to parse bundle lists that are downloaded from a provided bundle URI. Those lists might point to other lists, which could proceed to an arbitrary depth (and even create cycles). Restructure fetch_bundle_uri() to have an internal version that has a recursion depth. Compare that to a new max_bundle_uri_depth constant that is twice as high as we expect this depth to be for any legitimate use of bundle list linking.
We can consider making max_bundle_uri_depth a configurable value if there is demonstrated value in the future.
Signed-off-by: Derrick Stolee <derrickstolee@github.com> --- bundle-uri.c | 21 ++++++++++++++++++++- 1 file changed, 20 insertions(+), 1 deletion(-)
diff --git a/bundle-uri.c b/bundle-uri.c index ff215422888..74a26ce6c00 100644 --- a/bundle-uri.c +++ b/bundle-uri.c @@ -308,11 +308,25 @@ static int unbundle_from_file(struct repository *r, const char *file) return result; } -int fetch_bundle_uri(struct repository *r, const char *uri) +/** + * This limits the recursion on fetch_bundle_uri_internal() when following + * bundle lists. + */ +static int max_bundle_uri_depth = 4; + +static int fetch_bundle_uri_internal(struct repository *r, + const char *uri, + int depth) { int result = 0; struct strbuf filename = STRBUF_INIT; + if (depth >= max_bundle_uri_depth) { + warning(_("exceeded bundle URI recursion limit (%d)"), + max_bundle_uri_depth); + return -1; + } + find_temp_filename(&filename); if ((result = copy_uri_to_file(uri, filename.buf))) goto cleanup; @@ -335,6 +349,11 @@ cleanup: return result; } +int fetch_bundle_uri(struct repository *r, const char *uri) +{ + return fetch_bundle_uri_internal(r, uri, 0); +} + /** * General API for {transport,connect}.c etc. */
-- gitgitgadget