search

annexi-strayline / AURA

The AURA Reference Implementation
BSD 3-Clause "New" or "Revised" License
22 stars 0 forks source link

Git sometimes overflows its output buffers when caching a repo #2

Closed Richard-Wai closed 3 years ago

Richard-Wai commented 3 years ago

User made a report via Reddit.

When caching git repositories, the git command has it's STDOUT and STDERR captured into separate Bounded Strings. These Bounded Strings have a limit of 2048 (Characters). Some users may experience these buffers being overflowed, causing AURA to fail to cache the repository.

This decision was made out of a security-minded defensive coding approach. Generally we don't want to take in unbounded data from an uncontrolled source. In this case, we don't know if we're truly executing git.

However, considering where AURA is generally used, this might be an acceptable risk.

Will consider changing these buffers to unbounded strings.

Richard-Wai commented 3 years ago

After having some time to really sit-down and look at this issue, the solution became very obvious. The patch does two things:

  1. Increase the buffer size to 8KB to allow some larger errors
  2. Appending to a full buffer truncates instead of raising an exception.

The result of this now is that the user will get at least 8KB of an error message if the git command fails, and otherwise, no matter how chatty, if git competes successfully, everything will be OK.