mirror of
https://github.com/go-gitea/gitea.git
synced 2026-10-19 16:18:11 +00:00
42b1f95261
Bound the memory used when parsing uploaded packages, so instances with low memory limits survive non-standard packages. 1. Metadata files are read through a size-limited reader, archives themselves stay unbounded so large payloads keep working 2. zstd decoding caps the window at 128 MiB, the zstd CLI default 3. RPM headers go through a first-party reader with rpmlib's size and array count limits that allocates only what the upload contains, until https://github.com/sassoftware/go-rpmutils/pull/44 is released. Signing still verifies the payload digest, and its signature header matches rpmsign's byte for byte 4. Swift and NuGet read the zip entry they size-checked, a duplicate name could stand in for it before 5. Terraform states check `LIMIT_SIZE_TERRAFORM_STATE` before parsing, NuGet symbol PDBs share a 256 MiB budget 6. Oversized container configs are rejected instead of stored without metadata, invalid Vagrant boxes answer 400 instead of 500 Signed-off-by: techknowlogick <git@tklk.dev> Co-authored-by: techknowlogick <git@tklk.dev> Co-authored-by: silverwind <me@silverwind.io> Co-authored-by: techknowlogick <techknowlogick@gitea.com>
27 lines
624 B
Go
27 lines
624 B
Go
// Copyright 2026 The Gitea Authors. All rights reserved.
|
|
// SPDX-License-Identifier: MIT
|
|
|
|
package packages
|
|
|
|
import (
|
|
"io"
|
|
"strings"
|
|
"testing"
|
|
|
|
"github.com/stretchr/testify/assert"
|
|
)
|
|
|
|
func TestLimitedReader(t *testing.T) {
|
|
data, err := io.ReadAll(NewLimitedReader(strings.NewReader("abc"), 3))
|
|
assert.NoError(t, err)
|
|
assert.Equal(t, "abc", string(data))
|
|
|
|
r := NewLimitedReader(strings.NewReader("abcd"), 3)
|
|
data, err = io.ReadAll(r)
|
|
assert.ErrorIs(t, err, ErrContentTooLarge)
|
|
assert.Equal(t, "abc", string(data))
|
|
n, err := r.Read(make([]byte, 8))
|
|
assert.Zero(t, n)
|
|
assert.ErrorIs(t, err, ErrContentTooLarge)
|
|
}
|