From 46faee559e656881be14c3c9809679756973e664 Mon Sep 17 00:00:00 2001 From: Bryce Kwon Date: Wed, 15 Jul 2026 20:32:24 -1000 Subject: Check max-blob-size up front and default to 10 MB Only the tree view honoured the limit, and only after loading the whole object. The default moves from unlimited to 10 MB so a fresh install never buffers a huge object whole. Zero still turns the limit off. --- source/ui-tree.c | 15 ++++++++------- 1 file changed, 8 insertions(+), 7 deletions(-) (limited to 'source/ui-tree.c') diff --git a/source/ui-tree.c b/source/ui-tree.c index 292bfc6..f820f1f 100644 --- a/source/ui-tree.c +++ b/source/ui-tree.c @@ -117,6 +117,14 @@ static int print_object(const struct object_id *oid, const char *path, const cha return 0; } + /* Reject an oversized object before reading it whole into memory. */ + if (ctx.cfg.max_blob_size && size / 1024 > (unsigned long)ctx.cfg.max_blob_size) { + cgit_print_error_page(413, "Too large", + "blob size (%luKB) exceeds display size limit (%dKB)", + size / 1024, ctx.cfg.max_blob_size); + return 0; + } + buf = odb_read_object(the_repository->objects, oid, &type, &size); if (!buf) { cgit_print_error_page(500, "Internal server error", @@ -138,13 +146,6 @@ static int print_object(const struct object_id *oid, const char *path, const cha } html(")\n"); - if (ctx.cfg.max_blob_size && size / 1024 > ctx.cfg.max_blob_size) { - htmlf("
blob size (%ldKB) exceeds display size limit (%dKB).
", - size / 1024, ctx.cfg.max_blob_size); - free(buf); - return 1; - } - if (is_binary) print_binary_buffer(buf, size); else -- cgit 2.12.1