From 7d68df86d18ed2e2698289cf2e424ab9b5472b6c Mon Sep 17 00:00:00 2001 From: Alexis Sellier Date: Sat, 13 May 2023 23:08:12 +0200 Subject: [PATCH] radicle: Only sign known refs This change ensures that we only sign refs in known categories. This prevents accidently signing a temporary ref or malformed ref. --- radicle/src/storage/git.rs | 15 +++++++++++++-- 1 file changed, 13 insertions(+), 2 deletions(-) diff --git a/radicle/src/storage/git.rs b/radicle/src/storage/git.rs index 9c329594..29b1da8d 100644 --- a/radicle/src/storage/git.rs +++ b/radicle/src/storage/git.rs @@ -440,7 +440,6 @@ impl ReadRepository for Repository { } fn references_of(&self, remote: &RemoteId) -> Result { - // TODO: Only return known refs, eg. heads/ rad/ tags/ etc.. let entries = self .backend .references_glob(format!("refs/namespaces/{remote}/*").as_str())?; @@ -451,8 +450,20 @@ impl ReadRepository for Repository { let name = e.name().ok_or(Error::InvalidRef)?; let (_, refname) = git::parse_ref::(name)?; let oid = e.target().ok_or(Error::InvalidRef)?; + let (_, category, _, _) = refname.non_empty_components(); - refs.insert(refname.into(), oid.into()); + // Only sign known ref categories. + if [ + git::name::HEADS, + git::name::TAGS, + git::name::NOTES, + &git::name::component!("rad"), + &git::name::component!("cobs"), + ] + .contains(&category.as_ref()) + { + refs.insert(refname.into(), oid.into()); + } } Ok(refs.into()) }