laantungir/nak
1
0
Fork 0
mirror of https://github.com/fiatjaf/nak.git synced 2026-10-05 15:18:23 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #201 from mattn/fix/pr-pull-verify-tip

Browse Source 
git: verify the fetched pull request ref against the tip declared in the event
This commit is contained in:
mattn
2026-08-23 16:59:03 +00:00
committed by GitHub
parent 834477266a 9f19ab80c4
commit 63f1472a56
1 changed files with 14 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
git.go
+13 -1
View File
@@ -2828,10 +2828,22 @@ func gitFetchPullRequestIntoRef(ctx context.Context, repo nip34.Repository, prEv
// first try fetching the server ref that send/update pushed the tip to,
// which works even on servers that don't serve arbitrary commit hashes
log("fetching %s from %s...\n", color.CyanString(serverRef), color.BlueString(url))
fetchRefCmd := exec.Command("git", "fetch", url, fmt.Sprintf("%s:%s", serverRef, refName))
fetchRefCmd := exec.Command("git", "fetch", url, fmt.Sprintf("+%s:%s", serverRef, refName))
fetchRefCmd.Stderr = os.Stderr
if err := fetchRefCmd.Run(); err == nil {
if !gitHashRe.MatchString(commit) {
return refName, commit, nil
}
// make sure the server actually served the tip declared in the signed event
// (the declared tip may be abbreviated, so compare by prefix)
if output, err := exec.Command("git", "rev-parse", refName).Output(); err == nil &&
strings.HasPrefix(strings.TrimSpace(string(output)), commit) {
return refName, commit, nil
}
// it points elsewhere, refuse it and try the declared commit directly below
lastErr = fmt.Errorf("ref %s from %s doesn't match the declared tip %s", serverRef, url, shortCommitID(commit, 8))
} else {
lastErr = err
}