From 96099726ddb00b45135964220ce56468ba9fe184 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Ren=C3=A9=20Scharfe?= Date: Sun, 28 Feb 2021 12:22:47 +0100 Subject: archive: expand only a single %(describe) per archive MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Every %(describe) placeholder in $Format:...$ strings in files with the attribute export-subst is expanded by calling git describe. This can potentially result in a lot of such calls per archive. That's OK for local repositories under control of the user of git archive, but could be a problem for hosted repositories. Expand only a single %(describe) placeholder per archive for now to avoid denial-of-service attacks. We can make this limit configurable later if needed, but let's start out simple. Reported-by: Jeff King Signed-off-by: René Scharfe Signed-off-by: Junio C Hamano --- pretty.h | 5 +++++ 1 file changed, 5 insertions(+) (limited to 'pretty.h') diff --git a/pretty.h b/pretty.h index 7ce6c0b437..27b15947ff 100644 --- a/pretty.h +++ b/pretty.h @@ -23,6 +23,10 @@ enum cmit_fmt { CMIT_FMT_UNSPECIFIED }; +struct pretty_print_describe_status { + unsigned int max_invocations; +}; + struct pretty_print_context { /* * Callers should tweak these to change the behavior of pp_* functions. @@ -44,6 +48,7 @@ struct pretty_print_context { int color; struct ident_split *from_ident; unsigned encode_email_headers:1; + struct pretty_print_describe_status *describe_status; /* * Fields below here are manipulated internally by pp_* functions and -- cgit v1.2.3