revision: fix endless looping in revision parser #475
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Fixes a bug in the revision parser which caused an endless loop when
parsing revisions with opening braces "{" but no closing braces "}".
Example bad revisions:
- ^{/
- ~@{
- @@{{0
andrewpollock
pushed a commit
to google/osv.dev
that referenced
this pull request
Dec 5, 2022
[](https://renovatebot.com) This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [cloud.google.com/go/datastore](https://togithub.com/googleapis/google-cloud-go) | require | minor | `v1.8.0` -> `v1.10.0` | | [cloud.google.com/go/pubsub](https://togithub.com/googleapis/google-cloud-go) | require | minor | `v1.24.0` -> `v1.27.1` | | [cloud.google.com/go/storage](https://togithub.com/googleapis/google-cloud-go) | require | minor | `v1.24.0` -> `v1.28.1` | | [github.com/go-git/go-git/v5](https://togithub.com/go-git/go-git) | require | minor | `v5.4.2` -> `v5.5.0` | | [github.com/google/go-cmp](https://togithub.com/google/go-cmp) | require | patch | `v0.5.8` -> `v0.5.9` | | [golang.org/x/sync](https://togithub.com/golang/sync) | require | minor | `v0.0.0-20220601150217-0de741cfad7f` -> `v0.1.0` | | [google.golang.org/api](https://togithub.com/googleapis/google-api-go-client) | require | minor | `v0.91.0` -> `v0.103.0` | --- ### Release Notes <details> <summary>go-git/go-git</summary> ### [`v5.5.0`](https://togithub.com/go-git/go-git/releases/tag/v5.5.0) [Compare Source](https://togithub.com/go-git/go-git/compare/v5.4.2...v5.5.0) #### What's Changed - \*: add collision resistent SHA1 implementation by [@​pjbgf](https://togithub.com/pjbgf) in [go-git/go-git#618 - \*: replace go-homedir with os.UserHomeDir by [@​mvdan](https://togithub.com/mvdan) in [go-git/go-git#535 - Remote: add RemoteURL to {Fetch,Pull,Push}Options by [@​noerw](https://togithub.com/noerw) in [go-git/go-git#375 - Remote: Push, add support to push commits per hashes by [@​tjamet](https://togithub.com/tjamet) in [go-git/go-git#325 - Remote: Push, add ForceWithLease Push Option by [@​john-cai](https://togithub.com/john-cai) in [go-git/go-git#404 - Remote: PushOptions add push-options by [@​S-Bohn](https://togithub.com/S-Bohn) in [go-git/go-git#399 - Remote: Push, add atomic to push options by [@​john-cai](https://togithub.com/john-cai) in [go-git/go-git#406 - Remote: add FollowTags option for pushes by [@​john-cai](https://togithub.com/john-cai) in [go-git/go-git#385 - Worktree: use syscall.Timespec.Unix by [@​tklauser](https://togithub.com/tklauser) in [go-git/go-git#437 - Worktree: Checkout, simplified sparse checkout by [@​john-cai](https://togithub.com/john-cai) in [go-git/go-git#410 - Repository: don't crash accessing invalid pathinfo by [@​muesli](https://togithub.com/muesli) in [go-git/go-git#443 - storage: filesystem, switch from os.SEEK_\* to io.Seek\* by [@​abhinav](https://togithub.com/abhinav) in [go-git/go-git#421 - config: add branch description support by [@​ninedraft](https://togithub.com/ninedraft) in [go-git/go-git#409 - revision: fix endless looping in revision parser by [@​michenriksen](https://togithub.com/michenriksen) in [go-git/go-git#475 - pumbling: optimise zlib reader and consolidate sync.Pools by [@​pjbgf](https://togithub.com/pjbgf) in [go-git/go-git#608 - pumbling: parse optimisations by [@​pjbgf](https://togithub.com/pjbgf) in [go-git/go-git#602 - plumbing: object, rename calculation uses too much memory by [@​jfontan](https://togithub.com/jfontan) in [go-git/go-git#503 - plumbing: protocol/pakp and server, include the contents of `GO_GIT_USER_AGENT_EXTRA`. Fixes [#​529](https://togithub.com/go-git/go-git/issues/529) by [@​stewing](https://togithub.com/stewing) in [go-git/go-git#531 - plumbing: protocol/pakp, avoid duplicate encoding when overriding a Capability value. by [@​tylerchr](https://togithub.com/tylerchr) in [go-git/go-git#521 - plumbing: protocol/pakp, update agent by [@​caarlos0](https://togithub.com/caarlos0) in [go-git/go-git#453 - plumbing: protocol/pakp: Actions should have type Action by [@​abhinav](https://togithub.com/abhinav) in [go-git/go-git#420 - plumbing: protocol/pakp: allow unsupported `multi_ack` capability by [@​pjbgf](https://togithub.com/pjbgf) in [go-git/go-git#613 - plumbing: transport/ssh, auto-populate HostKeyAlgorithms. Fixes [#​411](https://togithub.com/go-git/go-git/issues/411) by [@​evanelias](https://togithub.com/evanelias) in [go-git/go-git#548 - pumbling: format/packfile, resolve external reference delta by [@​ga-paul-t](https://togithub.com/ga-paul-t) in [go-git/go-git#392 - plumbing: format/packfile, prevent large objects from being read into memory completely by [@​zeripath](https://togithub.com/zeripath) in [go-git/go-git#330 - plumbing: format/index, support v3 index by [@​john-cai](https://togithub.com/john-cai) in [go-git/go-git#407 - plumbing: format/gitignore, Read .git/info/exclude file too. by [@​enisdenjo](https://togithub.com/enisdenjo) in [go-git/go-git#402 - plumbing: format/gitattributes, Avoid index out of range by [@​To1ne](https://togithub.com/To1ne) in [go-git/go-git#598 - plumbing: format/config, Branch name with hash can be cloned. Fixes [#​309](https://togithub.com/go-git/go-git/issues/309) by [@​dowy](https://togithub.com/dowy) in [go-git/go-git#354 - go.mod: update github.com/xanzy/ssh-agent to v0.3.1 by [@​tklauser](https://togithub.com/tklauser) in [go-git/go-git#403 - go.mod: update dependencies to remove supply chain CVEs by [@​pjbgf](https://togithub.com/pjbgf) in [go-git/go-git#620 - examples: added "tag find if head is tagged" by [@​snebel29](https://togithub.com/snebel29) in [go-git/go-git#374 - examples: remote fix typo by [@​nep-0](https://togithub.com/nep-0) in [go-git/go-git#408 **Full Changelog**: go-git/go-git@v5.4.2...v5.5.0 </details> <details> <summary>google/go-cmp</summary> ### [`v0.5.9`](https://togithub.com/google/go-cmp/releases/tag/v0.5.9) [Compare Source](https://togithub.com/google/go-cmp/compare/v0.5.8...v0.5.9) Reporter changes: - ([#​299](https://togithub.com/google/go-cmp/issues/299)) Adjust heuristic for line-based versus byte-based diffing - ([#​306](https://togithub.com/google/go-cmp/issues/306)) Use `value.TypeString` in `PathStep.String` Code cleanup changes: - ([#​297](https://togithub.com/google/go-cmp/issues/297)) Use `reflect.Value.IsZero` - ([#​304](https://togithub.com/google/go-cmp/issues/304)) Format with Go 1.19 formatter - ([#​300](https://togithub.com/google/go-cmp/issues/300) )Fix typo in Result documentation - ([#​302](https://togithub.com/google/go-cmp/issues/302)) Pre-declare global type variables - ([#​309](https://togithub.com/google/go-cmp/issues/309)) Run tests on Go 1.19 </details> <details> <summary>googleapis/google-api-go-client</summary> ### [`v0.103.0`](https://togithub.com/googleapis/google-api-go-client/releases/tag/v0.103.0) [Compare Source](https://togithub.com/googleapis/google-api-go-client/compare/v0.102.0...v0.103.0) ##### Features - **all:** Auto-regenerate discovery clients ([#​1737](https://togithub.com/googleapis/google-api-go-client/issues/1737)) ([de99200](https://togithub.com/googleapis/google-api-go-client/commit/de9920088db16562740c31183eca6651f669e582)) - **all:** Auto-regenerate discovery clients ([#​1739](https://togithub.com/googleapis/google-api-go-client/issues/1739)) ([bbd4259](https://togithub.com/googleapis/google-api-go-client/commit/bbd42597f4710f527f83fd900cb7f9e6706bc195)) - **all:** Auto-regenerate discovery clients ([#​1743](https://togithub.com/googleapis/google-api-go-client/issues/1743)) ([4248dc3](https://togithub.com/googleapis/google-api-go-client/commit/4248dc3db6b32d00720293980fb8e845b684fbd8)) - **googleapi:** Inject gax apierror.APIError into googleapi.Error ([#​1730](https://togithub.com/googleapis/google-api-go-client/issues/1730)) ([ee25e29](https://togithub.com/googleapis/google-api-go-client/commit/ee25e29fd586cde25a006504d0059194a90f19ac)) - Rm hard dep on x/sys ([#​1742](https://togithub.com/googleapis/google-api-go-client/issues/1742)) ([9695aa1](https://togithub.com/googleapis/google-api-go-client/commit/9695aa13a084c1ad9857db4a6c12d57e13fc00dc)) ### [`v0.102.0`](https://togithub.com/googleapis/google-api-go-client/releases/tag/v0.102.0) [Compare Source](https://togithub.com/googleapis/google-api-go-client/compare/v0.101.0...v0.102.0) ##### Features - **all:** Auto-regenerate discovery clients ([#​1725](https://togithub.com/googleapis/google-api-go-client/issues/1725)) ([06360d8](https://togithub.com/googleapis/google-api-go-client/commit/06360d8f37b88e064a8a60788077f376b597d942)) - **all:** Auto-regenerate discovery clients ([#​1727](https://togithub.com/googleapis/google-api-go-client/issues/1727)) ([1e1eab9](https://togithub.com/googleapis/google-api-go-client/commit/1e1eab98aac0e967a6c52b65fe9eb5a4d6d8a946)) - **all:** Auto-regenerate discovery clients ([#​1734](https://togithub.com/googleapis/google-api-go-client/issues/1734)) ([ce57a67](https://togithub.com/googleapis/google-api-go-client/commit/ce57a67eddb98f3ccd21c1c01dfcb18df0d77009)) - Rely on new compute metadata module directly ([#​1736](https://togithub.com/googleapis/google-api-go-client/issues/1736)) ([0528475](https://togithub.com/googleapis/google-api-go-client/commit/0528475d51393bb6e3244816d9c6ea8c16275677)) ### [`v0.101.0`](https://togithub.com/googleapis/google-api-go-client/releases/tag/v0.101.0) [Compare Source](https://togithub.com/googleapis/google-api-go-client/compare/v0.100.0...v0.101.0) ##### Features - **all:** Auto-regenerate discovery clients ([#​1718](https://togithub.com/googleapis/google-api-go-client/issues/1718)) ([453b81a](https://togithub.com/googleapis/google-api-go-client/commit/453b81ac138e6572e9d6a3373c033c5abbcefbcc)) - **all:** Auto-regenerate discovery clients ([#​1720](https://togithub.com/googleapis/google-api-go-client/issues/1720)) ([9140608](https://togithub.com/googleapis/google-api-go-client/commit/91406081538e06ab580f59d6fba001dc34f8574a)) - **all:** Auto-regenerate discovery clients ([#​1723](https://togithub.com/googleapis/google-api-go-client/issues/1723)) ([f4788b3](https://togithub.com/googleapis/google-api-go-client/commit/f4788b325bd76337216a54e02e49cec4e3ee6987)) ### [`v0.100.0`](https://togithub.com/googleapis/google-api-go-client/releases/tag/v0.100.0) [Compare Source](https://togithub.com/googleapis/google-api-go-client/compare/v0.99.0...v0.100.0) ##### Features - **all:** Auto-regenerate discovery clients ([#​1712](https://togithub.com/googleapis/google-api-go-client/issues/1712)) ([f9e15f2](https://togithub.com/googleapis/google-api-go-client/commit/f9e15f2159928974af1a2ec539e20f17f94aab4d)) - **all:** Auto-regenerate discovery clients ([#​1717](https://togithub.com/googleapis/google-api-go-client/issues/1717)) ([f990a2a](https://togithub.com/googleapis/google-api-go-client/commit/f990a2af6cd6210c8764bbe273a575886ea97038)) - **internal/gensupport:** Remove DetermineContentType, use gax-go copy ([#​1716](https://togithub.com/googleapis/google-api-go-client/issues/1716)) ([37f90e9](https://togithub.com/googleapis/google-api-go-client/commit/37f90e974e83f06962ac923c502cd1b405c7f0fb)) ##### Bug Fixes - **idtoken:** Allow missing age in http response header ([#​1715](https://togithub.com/googleapis/google-api-go-client/issues/1715)) ([b235b1f](https://togithub.com/googleapis/google-api-go-client/commit/b235b1f8c718be6b8f361074d371768617a3da3a)) ### [`v0.99.0`](https://togithub.com/googleapis/google-api-go-client/releases/tag/v0.99.0) [Compare Source](https://togithub.com/googleapis/google-api-go-client/compare/v0.98.0...v0.99.0) ##### Features - **all:** Auto-regenerate discovery clients ([#​1701](https://togithub.com/googleapis/google-api-go-client/issues/1701)) ([6b81c83](https://togithub.com/googleapis/google-api-go-client/commit/6b81c8355addd65f718bb9195e1c2356117e1a1b)) ### [`v0.98.0`](https://togithub.com/googleapis/google-api-go-client/releases/tag/v0.98.0) [Compare Source](https://togithub.com/googleapis/google-api-go-client/compare/v0.97.0...v0.98.0) ##### Features - **all:** Auto-regenerate discovery clients ([#​1696](https://togithub.com/googleapis/google-api-go-client/issues/1696)) ([aa775b4](https://togithub.com/googleapis/google-api-go-client/commit/aa775b41d2e419002d4e7e7a390745dd2d07110a)) - **all:** Auto-regenerate discovery clients ([#​1699](https://togithub.com/googleapis/google-api-go-client/issues/1699)) ([25b7450](https://togithub.com/googleapis/google-api-go-client/commit/25b7450d0d9efc46d4095d827f597ac85bb8b5b4)) ### [`v0.97.0`](https://togithub.com/googleapis/google-api-go-client/releases/tag/v0.97.0) [Compare Source](https://togithub.com/googleapis/google-api-go-client/compare/v0.96.0...v0.97.0) ##### Features - **all:** Auto-regenerate discovery clients ([#​1693](https://togithub.com/googleapis/google-api-go-client/issues/1693)) ([a87400b](https://togithub.com/googleapis/google-api-go-client/commit/a87400be9341608f73e9ae1b5dbbecc7adfbf609)) - **all:** Auto-regenerate discovery clients ([#​1695](https://togithub.com/googleapis/google-api-go-client/issues/1695)) ([b8f2556](https://togithub.com/googleapis/google-api-go-client/commit/b8f25561a76841c7549a358925eb7bfc2236465e)) - **internal/gensupport:** Wrap retry failures with context and prev error ([#​1684](https://togithub.com/googleapis/google-api-go-client/issues/1684)) ([f427ee3](https://togithub.com/googleapis/google-api-go-client/commit/f427ee3edede981524c2ffb57fd2d8981f8cf8b4)), refs [#​1685](https://togithub.com/googleapis/google-api-go-client/issues/1685) ##### Bug Fixes - Build script bash error ([#​1697](https://togithub.com/googleapis/google-api-go-client/issues/1697)) ([6b0515b](https://togithub.com/googleapis/google-api-go-client/commit/6b0515bf05d8c62007748827eed486c607af483b)) - **gensupport:** Allow initial request for resumable uploads to retry w/ non-nil getBody ([#​1690](https://togithub.com/googleapis/google-api-go-client/issues/1690)) ([2c3e863](https://togithub.com/googleapis/google-api-go-client/commit/2c3e8638afc6702dcba732a1aa07ccb33eb9304b)) ### [`v0.96.0`](https://togithub.com/googleapis/google-api-go-client/releases/tag/v0.96.0) [Compare Source](https://togithub.com/googleapis/google-api-go-client/compare/v0.95.0...v0.96.0) ##### Features - **all:** Auto-regenerate discovery clients ([#​1686](https://togithub.com/googleapis/google-api-go-client/issues/1686)) ([ce5ed41](https://togithub.com/googleapis/google-api-go-client/commit/ce5ed411756019b79c77e580670fccc8c08cccca)) - **all:** Auto-regenerate discovery clients ([#​1688](https://togithub.com/googleapis/google-api-go-client/issues/1688)) ([bc29a6b](https://togithub.com/googleapis/google-api-go-client/commit/bc29a6b8a0489e88796d5a00d4c06769793ace0d)) - **all:** Auto-regenerate discovery clients ([#​1689](https://togithub.com/googleapis/google-api-go-client/issues/1689)) ([e801e10](https://togithub.com/googleapis/google-api-go-client/commit/e801e1051020e6721f2217f5aa3a4064399115e1)) ##### Bug Fixes - Upgrade version of golang.org/x/net ([#​1692](https://togithub.com/googleapis/google-api-go-client/issues/1692)) ([0f7c1ed](https://togithub.com/googleapis/google-api-go-client/commit/0f7c1ed65ca2c6212f21e7fce20aa5ab9952bdbc)), refs [#​1691](https://togithub.com/googleapis/google-api-go-client/issues/1691) ### [`v0.95.0`](https://togithub.com/googleapis/google-api-go-client/releases/tag/v0.95.0) [Compare Source](https://togithub.com/googleapis/google-api-go-client/compare/v0.94.0...v0.95.0) ##### Features - **all:** Auto-regenerate discovery clients ([#​1677](https://togithub.com/googleapis/google-api-go-client/issues/1677)) ([8757dbf](https://togithub.com/googleapis/google-api-go-client/commit/8757dbf5811cc9f4092a8259d859c35ad3cc6442)) - **all:** Auto-regenerate discovery clients ([#​1680](https://togithub.com/googleapis/google-api-go-client/issues/1680)) ([8c72fb3](https://togithub.com/googleapis/google-api-go-client/commit/8c72fb345fb6e377fa984053ca9c00aa0c3a0985)) - **option:** Officially deprecate ImpersonateCredentials ([#​1683](https://togithub.com/googleapis/google-api-go-client/issues/1683)) ([9a84077](https://togithub.com/googleapis/google-api-go-client/commit/9a84077014f9a37335d29132e373b92adf49f904)) ### [`v0.94.0`](https://togithub.com/googleapis/google-api-go-client/releases/tag/v0.94.0) [Compare Source](https://togithub.com/googleapis/google-api-go-client/compare/v0.93.0...v0.94.0) ##### Features - **all:** auto-regenerate discovery clients, refs [#​1676](https://togithub.com/googleapis/google-api-go-client/issues/1676) [#​1673](https://togithub.com/googleapis/google-api-go-client/issues/1673) [#​1672](https://togithub.com/googleapis/google-api-go-client/issues/1672) [#​1671](https://togithub.com/googleapis/google-api-go-client/issues/1671) [#​1667](https://togithub.com/googleapis/google-api-go-client/issues/1667) ##### Bug Fixes - **storage:** \*int64 instead of int64 for Age cond ([#​1598](https://togithub.com/googleapis/google-api-go-client/issues/1598)) ([9ea025d](https://togithub.com/googleapis/google-api-go-client/commit/9ea025dcfe9b67a95e08f4ec94ed4fb6a9767b8c)) ##### Documentation - **option:** clarify behavior of WithScopes ([#​1670](https://togithub.com/googleapis/google-api-go-client/issues/1670)) ([07ceb9d](https://togithub.com/googleapis/google-api-go-client/commit/07ceb9d607c85ffaa5bea97be66cf9d426ec55bb)), refs [#​1644](https://togithub.com/googleapis/google-api-go-client/issues/1644) ### [`v0.93.0`](https://togithub.com/googleapis/google-api-go-client/releases/tag/v0.93.0) [Compare Source](https://togithub.com/googleapis/google-api-go-client/compare/v0.92.0...v0.93.0) ##### Features - **all:** auto-regenerate discovery clients, refs [#​1664](https://togithub.com/googleapis/google-api-go-client/issues/1664) [#​1662](https://togithub.com/googleapis/google-api-go-client/issues/1662) [#​1661](https://togithub.com/googleapis/google-api-go-client/issues/1661) [#​1652](https://togithub.com/googleapis/google-api-go-client/issues/1652) - **google-api-go-generator:** Change field PaymentState to pointer ([#​1663](https://togithub.com/googleapis/google-api-go-client/issues/1663)) ([d6ee425](https://togithub.com/googleapis/google-api-go-client/commit/d6ee425a65668ee28ff97c6fb70f3497865d6572)), refs [#​727](https://togithub.com/googleapis/google-api-go-client/issues/727) ### [`v0.92.0`](https://togithub.com/googleapis/google-api-go-client/releases/tag/v0.92.0) [Compare Source](https://togithub.com/googleapis/google-api-go-client/compare/v0.91.0...v0.92.0) ##### Features - **all:** auto-regenerate discovery clients, refs [#​1649](https://togithub.com/googleapis/google-api-go-client/issues/1649) [#​1646](https://togithub.com/googleapis/google-api-go-client/issues/1646) [#​1645](https://togithub.com/googleapis/google-api-go-client/issues/1645) [#​1643](https://togithub.com/googleapis/google-api-go-client/issues/1643) [#​1641](https://togithub.com/googleapis/google-api-go-client/issues/1641) </details> --- ### Configuration 📅 **Schedule**: Branch creation - "before 6am on monday" in timezone Australia/Sydney, Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://togithub.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://www.mend.io/free-developer-tools/renovate/). View repository job log [here](https://app.renovatebot.com/dashboard#github/google/osv.dev). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzNC45LjEiLCJ1cGRhdGVkSW5WZXIiOiIzNC40OC4xIn0=-->
](https://renovatebot.com){kind=link}
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Hello there!
This PR fixes a bug in the revision parser which would cause an endless loop when parsing revisions containing opening braces
{but no closing braces}.The bug is fixed by adding a check that breaks the
forloop if the token ends up aseofin situations where the loop is looking for the closing brace.The bug was found with the help of go-fuzz. Let me know if you're interested in the fuzz test setup in case you want to exercise the parsing some more!