Hold a signature download to max-blob-size

A signature is a note a pusher stored, and the download read it whole
without the size check every other blob a page inflates goes through.

2 files changed, 23 insertions, 0 deletions

diff --git a/source/ui-snapshot.c b/source/ui-snapshot.cindex f4e79f7..bd5ebf2 100644--- a/source/ui-snapshot.c+++ b/source/ui-snapshot.c@@ -304,6 +304,17 @@ static int send_sig(const struct cgit_snapshot_format *format, const char *hex, 		return 0; 	} +	// A note is any blob a pusher stored, so it is held to the same bound+	// as every other blob a page inflates.+	if (odb_read_object_info(the_repository->objects, note, &size) != OBJ_BLOB) {+		cgit_print_error_page(404, "Not Found", "Not found");+		return 0;+	}+	if (cgit_blob_too_large(size)) {+		cgit_print_blob_too_large(size);+		return 0;+	}+ 	buf = odb_read_object(the_repository->objects, note, &type, &size); 	if (!buf) { 		cgit_print_error_page(404, "Not Found", "Not found");
diff --git a/source/ui-snapshot.c b/source/ui-snapshot.c
index f4e79f7..bd5ebf2 100644
--- a/source/ui-snapshot.c
+++ b/source/ui-snapshot.c
@@ -304,6 +304,17 @@ static int send_sig(const struct cgit_snapshot_format *format, const char *hex,
 		return 0;
 	}
 
+	// A note is any blob a pusher stored, so it is held to the same bound
+	// as every other blob a page inflates.
+	if (odb_read_object_info(the_repository->objects, note, &size) != OBJ_BLOB) {
+		cgit_print_error_page(404, "Not Found", "Not found");
+		return 0;
+	}
+	if (cgit_blob_too_large(size)) {
+		cgit_print_blob_too_large(size);
+		return 0;
+	}
+
 	buf = odb_read_object(the_repository->objects, note, &type, &size);
 	if (!buf) {
 		cgit_print_error_page(404, "Not Found", "Not found");
diff --git a/tests/t0110-snapshot.sh b/tests/t0110-snapshot.shindex 2ce8316..c38b3c3 100755--- a/tests/t0110-snapshot.sh+++ b/tests/t0110-snapshot.sh@@ -190,4 +190,16 @@ test_expect_success 'a snapshot name leads to the tag ahead of a branch' ' 	test "$(gzip -dc tag.tar.gz | git -C repos/vtags get-tar-commit-id)" = "$(git -C repos/vtags rev-parse refs/tags/v1.0^{commit})" ' +# A signature is a note a pusher stored, held to max-blob-size like any blob.+test_expect_success 'a signature past max-blob-size is refused' '+	big=$(test_seq 1 2000 | git -C repos/vtags hash-object -w --stdin) &&+	git -C repos/vtags notes --ref signatures/tar.gz add -C $big v1.0 &&+	{+		echo "max-blob-size=1" &&+		cat vtagsrc+	} >sigrc &&+	CGIT_CONFIG="$PWD/sigrc" QUERY_STRING="url=vtags/snapshot/vtags-1.0.tar.gz.asc" cgit >tmp &&+	grep "^Status: 413" tmp+'+ test_done
diff --git a/tests/t0110-snapshot.sh b/tests/t0110-snapshot.sh
index 2ce8316..c38b3c3 100755
--- a/tests/t0110-snapshot.sh
+++ b/tests/t0110-snapshot.sh
@@ -190,4 +190,16 @@ test_expect_success 'a snapshot name leads to the tag ahead of a branch' '
 	test "$(gzip -dc tag.tar.gz | git -C repos/vtags get-tar-commit-id)" = "$(git -C repos/vtags rev-parse refs/tags/v1.0^{commit})"
 '
 
+# A signature is a note a pusher stored, held to max-blob-size like any blob.
+test_expect_success 'a signature past max-blob-size is refused' '
+	big=$(test_seq 1 2000 | git -C repos/vtags hash-object -w --stdin) &&
+	git -C repos/vtags notes --ref signatures/tar.gz add -C $big v1.0 &&
+	{
+		echo "max-blob-size=1" &&
+		cat vtagsrc
+	} >sigrc &&
+	CGIT_CONFIG="$PWD/sigrc" QUERY_STRING="url=vtags/snapshot/vtags-1.0.tar.gz.asc" cgit >tmp &&
+	grep "^Status: 413" tmp
+'
+
 test_done