Diff options
| -rw-r--r-- | source/ui-snapshot.c | 11 | |
| -rwxr-xr-x | tests/t0110-snapshot.sh | 12 |
2 files changed, 23 insertions, 0 deletions
diff --git a/source/ui-snapshot.c b/source/ui-snapshot.c index f4e79f7..bd5ebf2 100644 --- a/source/ui-snapshot.c +++ b/source/ui-snapshot.c @@ -304,6 +304,17 @@ static int send_sig(const struct cgit_snapshot_format *format, const char *hex, return 0; } + // A note is any blob a pusher stored, so it is held to the same bound + // as every other blob a page inflates. + if (odb_read_object_info(the_repository->objects, note, &size) != OBJ_BLOB) { + cgit_print_error_page(404, "Not Found", "Not found"); + return 0; + } + if (cgit_blob_too_large(size)) { + cgit_print_blob_too_large(size); + return 0; + } + buf = odb_read_object(the_repository->objects, note, &type, &size); if (!buf) { cgit_print_error_page(404, "Not Found", "Not found"); diff --git a/tests/t0110-snapshot.sh b/tests/t0110-snapshot.sh index 2ce8316..c38b3c3 100755 --- a/tests/t0110-snapshot.sh +++ b/tests/t0110-snapshot.sh @@ -190,4 +190,16 @@ test_expect_success 'a snapshot name leads to the tag ahead of a branch' ' test "$(gzip -dc tag.tar.gz | git -C repos/vtags get-tar-commit-id)" = "$(git -C repos/vtags rev-parse refs/tags/v1.0^{commit})" ' +# A signature is a note a pusher stored, held to max-blob-size like any blob. +test_expect_success 'a signature past max-blob-size is refused' ' + big=$(test_seq 1 2000 | git -C repos/vtags hash-object -w --stdin) && + git -C repos/vtags notes --ref signatures/tar.gz add -C $big v1.0 && + { + echo "max-blob-size=1" && + cat vtagsrc + } >sigrc && + CGIT_CONFIG="$PWD/sigrc" QUERY_STRING="url=vtags/snapshot/vtags-1.0.tar.gz.asc" cgit >tmp && + grep "^Status: 413" tmp +' + test_done |