Skip to content

fix: properly error for invalid tarballs #998

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 4 commits into from
Mar 1, 2025
Merged

fix: properly error for invalid tarballs #998

Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
0f3ba5c
fix: properly error for invalid tarballs
lucacasonato Mar 1, 2025
b704ac3
Fix
lucacasonato Mar 1, 2025
a4ab600
Update tarball.rs
lucacasonato Mar 1, 2025
8d4abb2
fmt
lucacasonato Mar 1, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
21 changes: 14 additions & 7 deletions api/src/tarball.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -102,7 +102,7 @@ pub async fn process_tarball(
let async_read = stream.into_async_read();
let mut tar = async_tar::Archive::new(async_read)
.entries()
.map_err(PublishError::UntarError)?;
.map_err(from_tarball_io_error)?;

let mut files = HashMap::new();
let mut case_insensitive_paths = HashSet::<CaseInsensitivePackagePath>::new();
Expand All @@ -126,7 +126,7 @@ pub async fn process_tarball(
};

while let Some(res) = tar.next().await {
let mut entry = res.map_err(PublishError::UntarError)?;
let mut entry = res.map_err(from_tarball_io_error)?;

let header = entry.header();
let path = String::from_utf8_lossy(&entry.path_bytes()).into_owned();
Expand Down Expand Up @@ -158,7 +158,7 @@ pub async fn process_tarball(
});
}

let size = header.size().map_err(PublishError::UntarError)?;
let size = header.size().map_err(from_tarball_io_error)?;
if size > max_file_size {
return Err(PublishError::FileTooLarge {
path,
Expand All @@ -180,7 +180,7 @@ pub async fn process_tarball(
entry
.read_to_end(&mut bytes)
.await
.map_err(PublishError::UntarError)?;
.map_err(from_tarball_io_error)?;

// sha256 hash the bytes
let hash = sha2::Sha256::digest(&bytes);
Expand Down Expand Up @@ -479,8 +479,8 @@ pub enum PublishError {
#[error("gcs upload error: {0}")]
GcsUploadError(GcsError),

#[error("untar error: {0}")]
UntarError(io::Error),
#[error("invalid tarball: {0}")]
InvalidTarball(io::Error),

#[error("database error")]
DatabaseError(#[from] sqlx::Error),
Expand Down Expand Up @@ -630,9 +630,9 @@ impl PublishError {
match self {
PublishError::GcsDownloadError(_) => None,
PublishError::GcsUploadError(_) => None,
PublishError::UntarError(_) => None,
PublishError::MissingTarball => None,
PublishError::DatabaseError(_) => None,
PublishError::InvalidTarball(_) => Some("invalidTarball"),
PublishError::LinkInTarball { .. } => Some("linkInTarball"),
PublishError::InvalidEntryType { .. } => Some("invalidEntryType"),
PublishError::InvalidPath { .. } => Some("invalidPath"),
Expand Down Expand Up @@ -686,6 +686,13 @@ impl PublishError {
}
}

fn from_tarball_io_error(err: io::Error) -> PublishError {
match err.downcast::<reqwest::Error>() {
Ok(err) => PublishError::GcsDownloadError(GcsError::Reqwest(err)),
Err(err) => PublishError::InvalidTarball(err),
}
}

pub struct FileInfo {
pub path: PackagePath,
pub size: u64,
Expand Down
Loading