mab122
/
radicle-heartwood-lfs
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

radicle: Only sign known refs 

This change ensures that we only sign refs in known categories. This
prevents accidently signing a temporary ref or malformed ref.
This commit is contained in:
Alexis Sellier 2023-05-13 23:08:12 +02:00
parent 1f711b394a
commit 7d68df86d1
No known key found for this signature in database
1 changed files with 13 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
radicle/src/storage/git.rs
View File

@ -440,7 +440,6 @@ impl ReadRepository for Repository {
} }
fn references_of(&self, remote: &RemoteId) -> Result<Refs, Error> { fn references_of(&self, remote: &RemoteId) -> Result<Refs, Error> {
// TODO: Only return known refs, eg. heads/ rad/ tags/ etc..
let entries = self let entries = self
.backend .backend
.references_glob(format!("refs/namespaces/{remote}/*").as_str())?; .references_glob(format!("refs/namespaces/{remote}/*").as_str())?;
@ -451,8 +450,20 @@ impl ReadRepository for Repository {
let name = e.name().ok_or(Error::InvalidRef)?; let name = e.name().ok_or(Error::InvalidRef)?;
let (_, refname) = git::parse_ref::<RemoteId>(name)?; let (_, refname) = git::parse_ref::<RemoteId>(name)?;
let oid = e.target().ok_or(Error::InvalidRef)?; let oid = e.target().ok_or(Error::InvalidRef)?;
let (_, category, _, _) = refname.non_empty_components();
refs.insert(refname.into(), oid.into()); // Only sign known ref categories.
if [
git::name::HEADS,
git::name::TAGS,
git::name::NOTES,
&git::name::component!("rad"),
&git::name::component!("cobs"),
]
.contains(&category.as_ref())
{
refs.insert(refname.into(), oid.into());
}
} }
Ok(refs.into()) Ok(refs.into())
} }