vole

Clone

Read only, no credentials:

https://rodent.software/vole.git

Write over SSH with a registered key:

git clone ssh://git@rodent.software:2222/vole.git

A free and open-source forge that lives in your Git repo.

#3

P0: Bound and stream untrusted read-path objects

closed · opened by keenan 13d ago

keenan opened this 13d ago

Why

Several anonymous read paths load whole Git blobs into memory:

server/web/codebrowser.go:180 — Blob/Raw uses g.BlobAt, which reads the entire blob before truncating or displaying.
server/web/overview.go — readmeAt does the same for a README.
server/pages/catfile.go — the cat-file --batch pool allocates the full object for every site read.
metadata.LoadIssues / LoadRequests read every metadata blob in full.

A single large blob in a public repository can cause a large allocation per concurrent request.

Scope

Add a blob-size query and a capped prefix-read helper.
Stream /raw, release, LFS, and artifact downloads instead of buffering.
Cap inline rendering, README size, site blob size, and syntax-highlight input.
Add metadata file size and count limits, enforced at web-write and pre-receive.
Return a clear 413/truncated response instead of silently allocating.

Acceptance

A 50–100 MiB blob is served or rejected without proportional per-request heap growth.
Tests cover Blob, Raw, README, pages, and metadata loading.

Comments (0)

No comments yet.