From 1b84b06bc69580427d98e2e7e8e20a99b8bd1f43 Mon Sep 17 00:00:00 2001 From: Bryce Kwon Date: Sat, 7 Nov 2026 16:33:01 -1000 Subject: Hold the mailmap to max-blob-size git's read_mailmap_blob inflates the whole blob, so a pusher could make every page of a repository read as much as they liked. git reads a note and the .gitmodules file whole as well, and capping those would mean bounding the lookups where the log, commit and tree pages make them, so the manual names them instead. Nothing tested that mailmap.file and mailmap.blob are ignored either. --- tests/t0303-robustness.sh | 31 +++++++++++++++++++++++++++++++ 1 file changed, 31 insertions(+) (limited to 'tests') diff --git a/tests/t0303-robustness.sh b/tests/t0303-robustness.sh index 2472bcd..b189334 100755 --- a/tests/t0303-robustness.sh +++ b/tests/t0303-robustness.sh @@ -935,4 +935,35 @@ test_expect_success 'descriptive values from a scanned repository are escaped' ' test_grep ! "" tmp ' +# A repository's own config cannot point the mailmap reader at a file on the +# server or another blob, and git reads the mailmap whole, so one past +# max-blob-size is passed over like any other large blob. +test_expect_success 'only a .mailmap at HEAD within max-blob-size is applied' ' + test_create_repo repos/mapped && + ( + cd repos/mapped && + echo content >file && + git add file && + GIT_AUTHOR_NAME="Old Name" GIT_AUTHOR_EMAIL=old@example.com \ + git commit -q -m first && + echo "New Name " >.mailmap && + test_seq -f "# padding line %d" 1 200 >>.mailmap && + echo "Blob Name " >other-map && + git add .mailmap other-map && + git commit -q -m "add the mailmaps" && + echo "File Name " >../map-on-disk && + git config mailmap.file "$PWD/../map-on-disk" && + git config mailmap.blob HEAD:other-map + ) && + test $(git -C repos/mapped cat-file -s HEAD:.mailmap) -ge 2048 && + cgitrc_repo mappedrc mapped && + cgit_ok mappedrc "url=mapped/log/" >tmp && + test_grep "New Name" tmp && + test_grep ! -e "File Name" -e "Blob Name" tmp && + cgitrc_repo mappedcaprc mapped max-blob-size=1 && + cgit_ok mappedcaprc "url=mapped/log/" >tmp && + test_grep "Old Name" tmp && + test_grep ! "New Name" tmp +' + test_done -- cgit 2.12.1