isomorphic-git 1.37.0 → 1.37.2

package/managers/index.cjs

@@ -4159,6 +4159,40 @@ async function readObjectPacked({
         const packFile = indexFile.replace(/idx$/, 'pack');
         p.pack = fs.read(packFile);
       }
+      const pack = await p.pack;
+
+      // === Packfile Integrity Verification ===
+      // Performance optimization: use _checksumVerified flag to verify only once per packfile
+      if (!p._checksumVerified) {
+        const expectedShaFromIndex = p.packfileSha;
+
+        // 1. Fast Check: Verify packfile trailer matches index record
+        // Use subarray instead of slice to avoid memory copy (zero-copy for large packfiles)
+        const packTrailer = pack.subarray(-20);
+        const packTrailerSha = Array.from(packTrailer)
+          .map(b => b.toString(16).padStart(2, '0'))
+          .join('');
+        if (packTrailerSha !== expectedShaFromIndex) {
+          throw new InternalError(
+            `Packfile trailer mismatch: expected ${expectedShaFromIndex}, got ${packTrailerSha}. The packfile may be corrupted.`
+          )
+        }
+
+        // 2. Deep Integrity Check: Calculate actual SHA-1 of packfile payload
+        // This ensures true data integrity by verifying the entire packfile content
+        // Use subarray for zero-copy reading of large files
+        const payload = pack.subarray(0, -20);
+        const actualPayloadSha = await shasum(payload);
+        if (actualPayloadSha !== expectedShaFromIndex) {
+          throw new InternalError(
+            `Packfile payload corrupted: calculated ${actualPayloadSha} but expected ${expectedShaFromIndex}. The packfile may have been tampered with.`
+          )
+        }
+
+        // Mark as verified to prevent performance regression on subsequent reads
+        p._checksumVerified = true;
+      }
+
       const result = await p.read({ oid, getExternalRefDelta });
       result.format = 'content';
       result.source = `objects/pack/${filename.replace(/idx$/, 'pack')}`;

package/managers/index.js

@@ -4153,6 +4153,40 @@ async function readObjectPacked({
         const packFile = indexFile.replace(/idx$/, 'pack');
         p.pack = fs.read(packFile);
       }
+      const pack = await p.pack;
+
+      // === Packfile Integrity Verification ===
+      // Performance optimization: use _checksumVerified flag to verify only once per packfile
+      if (!p._checksumVerified) {
+        const expectedShaFromIndex = p.packfileSha;
+
+        // 1. Fast Check: Verify packfile trailer matches index record
+        // Use subarray instead of slice to avoid memory copy (zero-copy for large packfiles)
+        const packTrailer = pack.subarray(-20);
+        const packTrailerSha = Array.from(packTrailer)
+          .map(b => b.toString(16).padStart(2, '0'))
+          .join('');
+        if (packTrailerSha !== expectedShaFromIndex) {
+          throw new InternalError(
+            `Packfile trailer mismatch: expected ${expectedShaFromIndex}, got ${packTrailerSha}. The packfile may be corrupted.`
+          )
+        }
+
+        // 2. Deep Integrity Check: Calculate actual SHA-1 of packfile payload
+        // This ensures true data integrity by verifying the entire packfile content
+        // Use subarray for zero-copy reading of large files
+        const payload = pack.subarray(0, -20);
+        const actualPayloadSha = await shasum(payload);
+        if (actualPayloadSha !== expectedShaFromIndex) {
+          throw new InternalError(
+            `Packfile payload corrupted: calculated ${actualPayloadSha} but expected ${expectedShaFromIndex}. The packfile may have been tampered with.`
+          )
+        }
+
+        // Mark as verified to prevent performance regression on subsequent reads
+        p._checksumVerified = true;
+      }
+
       const result = await p.read({ oid, getExternalRefDelta });
       result.format = 'content';
       result.source = `objects/pack/${filename.replace(/idx$/, 'pack')}`;