From cc35c579a5502e3a83356ea417b4911450785411 Mon Sep 17 00:00:00 2001
From: Tobias Bieniek <tobias@bieniek.cloud>
Date: Tue, 8 Apr 2025 12:07:58 +0200
Subject: [PATCH] Return errors if metadata name or version do not match
 manifest

---
 src/controllers/krate/publish.rs    | 16 ++++++++++++++++
 src/tests/krate/publish/manifest.rs | 24 ++++++++++++++++++++++++
 2 files changed, 40 insertions(+)

diff --git a/src/controllers/krate/publish.rs b/src/controllers/krate/publish.rs
index 3819be57e07..0e5a3b78cb1 100644
--- a/src/controllers/krate/publish.rs
+++ b/src/controllers/krate/publish.rs
@@ -171,6 +171,22 @@ pub async fn publish(app: AppState, req: Parts, body: Body) -> AppResult<Json<Go
     // we only accept manifests with a `package` section and without
     // inheritance.
     let package = tarball_info.manifest.package.unwrap();
+    if package.name != metadata.name {
+        let message = format!(
+            "metadata name `{}` does not match manifest name `{}`",
+            metadata.name, package.name
+        );
+        return Err(bad_request(message));
+    }
+
+    let manifest_version = package.version.map(|it| it.as_local().unwrap()).unwrap();
+    if manifest_version != metadata.vers {
+        let message = format!(
+            "metadata version `{}` does not match manifest version `{manifest_version}`",
+            metadata.vers
+        );
+        return Err(bad_request(message));
+    }
 
     let description = package.description.map(|it| it.as_local().unwrap());
     let mut license = package.license.map(|it| it.as_local().unwrap());
diff --git a/src/tests/krate/publish/manifest.rs b/src/tests/krate/publish/manifest.rs
index 6dbabc1cd45..c379ef78e66 100644
--- a/src/tests/krate/publish/manifest.rs
+++ b/src/tests/krate/publish/manifest.rs
@@ -127,6 +127,30 @@ async fn invalid_manifest_missing_version() {
     assert_snapshot!(response.text(), @r#"{"errors":[{"detail":"failed to parse `Cargo.toml` manifest file\n\nmissing field `version`"}]}"#);
 }
 
+#[tokio::test(flavor = "multi_thread")]
+async fn name_mismatch() {
+    let (_app, _anon, _cookie, token) = TestApp::full().with_token().await;
+
+    let response =
+        token.publish_crate(PublishBuilder::new("foo", "1.0.0").custom_manifest(
+            "[package]\nname = \"bar\"\nversion = \"1.0.0\"\ndescription = \"description\"\nlicense = \"MIT\"\n",
+        )).await;
+    assert_eq!(response.status(), StatusCode::BAD_REQUEST);
+    assert_snapshot!(response.text(), @r#"{"errors":[{"detail":"metadata name `foo` does not match manifest name `bar`"}]}"#);
+}
+
+#[tokio::test(flavor = "multi_thread")]
+async fn version_mismatch() {
+    let (_app, _anon, _cookie, token) = TestApp::full().with_token().await;
+
+    let response =
+        token.publish_crate(PublishBuilder::new("foo", "1.0.0").custom_manifest(
+            "[package]\nname = \"foo\"\nversion = \"2.0.0\"\ndescription = \"description\"\nlicense = \"MIT\"\n",
+        )).await;
+    assert_eq!(response.status(), StatusCode::BAD_REQUEST);
+    assert_snapshot!(response.text(), @r#"{"errors":[{"detail":"metadata version `1.0.0` does not match manifest version `2.0.0`"}]}"#);
+}
+
 #[tokio::test(flavor = "multi_thread")]
 async fn invalid_rust_version() {
     let (_app, _anon, _cookie, token) = TestApp::full().with_token().await;