gno.land/p/moul/gnopm/v0

Package

Overview

Kind: Pure package
Name: v0
Namespace: moul / gnopm
Files: 10 (README)(gnomod.toml)
Exported functions: n/a — not supported for pure packages by the node (vm/qfuncs)
Module: gno.land/p/moul/gnopm/v0
gno: 0.9

Files (10)

validate.gnogno

1package gnopm23import "strings"45// Size caps. Every string the chain stores is bounded: an unbounded field is an6// unbounded storage deposit, and on gno.land the deposit is paid per byte by7// whoever writes it.8

Functions

not supported for pure packages by the node (vm/qfuncs)

Signatures reconstructed verbatim from vm/qfuncs — interface params keep their inline definitions.

9 MaxPkgPathLen = 256

12 MaxRefLen = 255 // git's own limit for a single ref name

14 // MaxClaimants bounds how many addresses may claim one package path.

15 // Unbounded, it is a spam surface: one path with ten thousand claims is a

16 // Render that never returns and a listing nobody can read.

17 MaxClaimants = 16

20// ValidCommit reports whether s is a git object id: 40 (SHA-1) or 64 (SHA-256)

21// lowercase hex characters. Case is fixed so the same object always produces

22// the same stored bytes, and so a verifier comparing two claims compares two

23// comparable strings.

24func ValidCommit(s string) bool {

25 if len(s) != 40 && len(s) != 64 {

28 for i := 0; i < len(s); i++ {

30 if (c < '0' || c > '9') && (c < 'a' || c > 'f') {

37// ValidRepo reports whether s is a repository URL this registry accepts.

39// Deliberately narrow: "https://" only, a host, and a path. Not a taste

40// judgement about git transports, a safety one. Whatever is stored here is

41// eventually rendered as a link by this realm, by gnoweb and by every explorer

42// that reads the registry, and the set of schemes that are safe to hand a

43// browser is exactly one. "javascript:", "data:" and "file:" are the attack;

44// "git://" and "ssh://" are merely unreachable from a web page, and a claimant

45// who needs one can point at the https mirror every forge already serves.

46func ValidRepo(s string) bool {

47 if s == "" || len(s) > MaxRepoLen {

50 const scheme = "https://"

51 if !strings.HasPrefix(s, scheme) {

54 rest := s[len(scheme):]

55 if rest == "" || strings.HasPrefix(rest, "/") {

58 // A host must be present and must not be a userinfo trick

59 // ("https://github.com@evil.example/x" fetches from evil.example while

60 // reading as GitHub).

61 slash := strings.IndexByte(rest, '/')

64 host = rest[:slash]

66 if host == "" || strings.ContainsAny(host, "@:") {

69 if !strings.Contains(host, ".") {

72 for i := 0; i < len(s); i++ {

73 if !urlByteOK(s[i]) {

77 return !strings.Contains(s, "..")

80// urlByteOK is an allowlist, not a denylist: the printable ASCII that appears

81// in a real repository URL. Everything else, control characters and the bidi

82// overrides in particular, is refused rather than escaped, because a field that

83// can only hold safe bytes needs no escaping at any of its render sites.

84func urlByteOK(c byte) bool {

86 case c >= 'a' && c <= 'z', c >= 'A' && c <= 'Z', c >= '0' && c <= '9':

90 case '-', '.', '_', '~', ':', '/', '%', '+':

96// ValidDir reports whether s names the subdirectory of the repository holding

97// the package. Empty means the repository root, which is the common case for a

98// single-package repo and must stay expressible.

99func ValidDir(s string) bool {

103 if len(s) > MaxDirLen {

106 if strings.HasPrefix(s, "/") || strings.HasSuffix(s, "/") {

109 for _, p := range strings.Split(s, "/") {

110 if p == "" || p == "." || p == ".." {

113 for i := 0; i < len(p); i++ {

114 if !pathByteOK(p[i]) {

122func pathByteOK(c byte) bool {

124 case c >= 'a' && c <= 'z', c >= 'A' && c <= 'Z', c >= '0' && c <= '9':

128 case '-', '.', '_':

134// ValidRef reports whether s is a fully-qualified git ref, or empty.

136// The ref is optional and is never the thing that is verified: a ref moves, a

137// commit does not. It is recorded so a reader can tell a claim pinned to a

138// released tag from one pinned to a commit on nobody's branch, and so a

139// verifier can check the claimed commit is still reachable from it rather than

140// dangling behind a force-push.

141func ValidRef(s string) bool {

145 if len(s) > MaxRefLen || !strings.HasPrefix(s, "refs/") {

148 if strings.Contains(s, "..") || strings.Contains(s, "@{") {

151 if strings.HasSuffix(s, "/") || strings.HasSuffix(s, ".") {

154 parts := strings.Split(s, "/")

155 if len(parts) < 2 {

158 for _, p := range parts {

159 if p == "" || p == "@" || strings.HasPrefix(p, ".") || strings.HasSuffix(p, ".lock") {

162 for i := 0; i < len(p); i++ {

163 if !refByteOK(p[i]) {

171// refByteOK is an allowlist, and deliberately narrower than git's own rule.

173// git rejects a handful of metacharacters and permits everything else, which

174// leaves a ref free to contain a backtick, a pipe or a bracket. Every other

175// field here is an allowlist precisely so that no consumer has to escape

176// anything, and one denylist field would undo that for all of them: a ref

177// carrying a pipe breaks out of a markdown table cell, and one carrying a

178// backtick breaks out of the inline-code span a renderer wraps it in.

180// The cost is refs nobody writes. What stays expressible is every ref anyone

181// actually has: alphanumerics, and the four separators git tooling puts in a

183func refByteOK(c byte) bool {

185 case c >= 'a' && c <= 'z', c >= 'A' && c <= 'Z', c >= '0' && c <= '9':

189 case '-', '.', '_', '/', '+':

gno.land/p/moul/gnopm/v0⧉

gno.land/p/moul/gnopm/v0