@push.rocks/smartlinuxrepo 1.1.0 → 1.1.2

package/ts/arch/reader.ts

@@ -53,7 +53,7 @@ export async function readArchPackage(
   const walked = await withDecompressingReader(
     source,
     container.decoder,
-    { maxOutputBytes: limits.maxPayloadBytes, outputLimit: 'maxPayloadBytes' },
+    { maxOutputBytes: limits.maxPayloadBytes, outputLimit: 'maxPayloadBytes', maxZstdFrames: limits.maxEntries },
     async (payloadArg) => {
       const result = await walkPayload(
         new TarReader(payloadArg, { maxEntries: limits.maxEntries, maxHeaderBytes: limits.maxHeaderBytes }),

package/ts/debian/control.ts

@@ -1,7 +1,9 @@
+import { isIndexableArchitecture } from '../shared/architecture.js';
 import { LinuxRepoError, limitExceeded } from '../shared/errors.js';
 import { isValidUrl } from '../shared/url.js';
 import type { IDebianPackageMetadata } from '../shared/types.js';
 import { fromByteString, goTrimSpace, toByteString } from './gostring.js';
+import { hasPoolFileNameRefusedCharacter } from './rules.js';
 import { parseMailAddress } from './mailaddress.js';
 
 /**
@@ -29,7 +31,13 @@ export interface IDebianControl {
  * verbatim, and the Depends text split on `,` (`['']` when there is none).
  *
  * Gitea's scanner refuses lines over 64 KiB; the codec accepts lines up to
- * `maxLineBytes` (`maxHeaderBytes`), which is at least that.
+ * `maxLineBytes` (`maxHeaderBytes`), which is at least that. A version that
+ * matches Gitea's pattern but holds `/` or `?` (both inside the revision's
+ * range) is refused with `invalid-field` (`Version`): no pool file name can
+ * hold it (`hasPoolFileNameRefusedCharacter`), where Gitea accepts the upload
+ * and then cannot serve it. An Architecture that fails `isIndexableArchitecture`
+ * or `hasPoolFileNameRefusedCharacter` (decoded) is refused with
+ * `invalid-field` (`Architecture`), where Gitea accepts any non-empty value.
  */
 export function parseDebianControlFile(bytesArg: Uint8Array, maxLineBytesArg: number): IDebianControl {
   const text = toByteString(bytesArg);
@@ -121,7 +129,10 @@ export function parseDebianControlFile(bytesArg: Uint8Array, maxLineBytesArg: nu
   if (version === '') {
     throw new LinuxRepoError('missing-field', 'the control file has no Version field', { field: 'Version' });
   }
-  if (!VERSION_PATTERN.test(version)) {
+  // a departure from Gitea's version pattern: the revision range admits
+  // `/` and `?`, which the pool file name cannot hold, so the version is
+  // refused here rather than by buildDebianIndex
+  if (!VERSION_PATTERN.test(version) || hasPoolFileNameRefusedCharacter(version)) {
     throw new LinuxRepoError('invalid-field', 'the package version is invalid', {
       field: 'Version',
       value: fromByteString(version),
@@ -132,11 +143,22 @@ export function parseDebianControlFile(bytesArg: Uint8Array, maxLineBytesArg: nu
       field: 'Architecture',
     });
   }
+  // a departure from Gitea, which accepts any non-empty Architecture: the
+  // file name embeds it, so it must pass the builder's rules; checked on the
+  // decoded text the record carries (on the byte string, `\s` and `\p{Cc}`
+  // would match the UTF-8 continuation bytes 0x85 and 0xA0)
+  const decodedArchitecture = fromByteString(architecture);
+  if (!isIndexableArchitecture(decodedArchitecture) || hasPoolFileNameRefusedCharacter(decodedArchitecture)) {
+    throw new LinuxRepoError('invalid-field', 'the package architecture cannot name an index path or pool file', {
+      field: 'Architecture',
+      value: decodedArchitecture,
+    });
+  }
 
   return {
     name,
     version,
-    architecture: fromByteString(architecture),
+    architecture: decodedArchitecture,
     metadata: {
       control: fromByteString(goTrimSpace(control)),
       maintainer: fromByteString(maintainer),

package/ts/debian/indexbuilder.ts

@@ -2,11 +2,11 @@ import * as plugins from '../plugins.js';
 import { isIndexableArchitecture } from '../shared/architecture.js';
 import { LinuxRepoError } from '../shared/errors.js';
 import type { IDebianPackageRecord, ILinuxIndexFile } from '../shared/types.js';
-import { assertSegmentName, assertString, assertTimestamp } from '../shared/validation.js';
+import { assertString, assertTimestamp } from '../shared/validation.js';
 import type { IOpenPgpSigner } from '../signing/signers.js';
 import { createCleartextSignedMessage, createDetachedArmoredSignature } from '../signing/openpgpframing.js';
 import { compareUtf8, goTrimSpace, utf8ByteString } from './gostring.js';
-import { DEBIAN_SYMBOL_PATTERN, isDebianReleaseValue, isDebianSymbol } from './rules.js';
+import { DEBIAN_SYMBOL_PATTERN, hasPoolFileNameRefusedCharacter, isDebianReleaseValue, isDebianSymbol } from './rules.js';
 
 /** The fields the `Packages` stanza writes itself; a control file's own copies are dropped. */
 const INDEX_OWNED_FIELDS = new Set(['filename', 'size', 'md5sum', 'sha1', 'sha256', 'sha512']);
@@ -234,7 +234,8 @@ export function renderDebianPackagesStanza(input: {
 
 /**
  * Refuses a record the index cannot list: wrong format, an architecture that
- * is not a path segment, a file name that is not one, digests that are not
+ * is not a path segment, a file name apt cannot fetch as one pool path
+ * segment (`hasPoolFileNameRefusedCharacter`), digests that are not
  * hex of the right length, or a control text that is not one stanza (empty,
  * or holding a blank line that would start another stanza).
  */
@@ -249,12 +250,13 @@ function assertRecord(recordArg: IDebianPackageRecord): void {
       { field: 'record.architecture', value: String(recordArg.fileName) },
     );
   }
-  assertSegmentName(recordArg.fileName, 'record.fileName');
-  if (/\s/.test(recordArg.fileName)) {
-    throw new LinuxRepoError('invalid-input', 'record.fileName must not contain whitespace', {
-      field: 'record.fileName',
-      value: recordArg.fileName,
-    });
+  assertString(recordArg.fileName, 'record.fileName');
+  if (recordArg.fileName === '' || hasPoolFileNameRefusedCharacter(recordArg.fileName)) {
+    throw new LinuxRepoError(
+      'invalid-input',
+      'record.fileName must be non-empty and contain no "/", "#", "?", whitespace or control characters',
+      { field: 'record.fileName', value: recordArg.fileName },
+    );
   }
   const digests = recordArg.digests;
   if (digests === null || typeof digests !== 'object' || !Number.isSafeInteger(digests.size) || digests.size < 0) {

package/ts/debian/reader.ts

@@ -89,7 +89,11 @@ async function readControl(inputArg: PackageByteSource, limitsArg: Readonly<ILin
     const control = await withDecompressingReader(
       member.body,
       compression,
-      { maxOutputBytes: limitsArg.maxDecompressedMetadataBytes, outputLimit: 'maxDecompressedMetadataBytes' },
+      {
+        maxOutputBytes: limitsArg.maxDecompressedMetadataBytes,
+        outputLimit: 'maxDecompressedMetadataBytes',
+        maxZstdFrames: limitsArg.maxEntries,
+      },
       async (decompressed) => {
         const tar = new TarReader(decompressed, {
           maxEntries: limitsArg.maxEntries,

package/ts/debian/rules.ts

@@ -21,3 +21,24 @@ export function isDebianSymbol(valueArg: string): boolean {
 export function isDebianReleaseValue(valueArg: string): boolean {
   return typeof valueArg === 'string' && valueArg !== '' && !hasControlCharacter(valueArg) && valueArg === valueArg.trim();
 }
+
+/**
+ * The characters a pool file name (`<name>_<version>_<architecture>.deb`,
+ * written as a `Packages` `Filename`) must not hold: `/`, which would make it
+ * more than one path segment; whitespace and control characters, which split
+ * or end the field; and `#` and `?`, which apt sends unescaped in the request
+ * path (apt 2.6.1 `pkgAcquire::URIEncode` escapes only `%`, `+`, `~`, space,
+ * control and non-ASCII bytes), so a server reads the rest as a fragment or a
+ * query and apt cannot fetch the file.
+ */
+const POOL_FILE_NAME_REFUSED_PATTERN = /[/#?\s\p{Cc}]/u;
+
+/**
+ * Whether a text holds a character a pool file name must not hold. The one
+ * rule both `buildDebianIndex` (on `record.fileName`) and `readDebianPackage`
+ * (on the version and the decoded architecture) apply, so the reader never
+ * returns a record the builder refuses for its file name.
+ */
+export function hasPoolFileNameRefusedCharacter(textArg: string): boolean {
+  return POOL_FILE_NAME_REFUSED_PATTERN.test(textArg);
+}