From 99dc760b3a2f0e62db1caf70a6ac2044b56f9acf Mon Sep 17 00:00:00 2001 From: oppiliappan Date: Sun, 3 May 2026 09:17:34 +0100 Subject: [PATCH] appview: block arbitrary compares stopgap to deter bots Signed-off-by: oppiliappan --- appview/repo/compare.go | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/appview/repo/compare.go b/appview/repo/compare.go index 9f8bf4f5..0446e779 100644 --- a/appview/repo/compare.go +++ b/appview/repo/compare.go @@ -5,6 +5,7 @@ import ( "fmt" "net/http" "net/url" + "regexp" "strings" "tangled.org/core/api/tangled" @@ -17,6 +18,8 @@ import ( "github.com/go-chi/chi/v5" ) +var shaPattern = regexp.MustCompile(`^[0-9a-f]{4,40}$`) + func (rp *Repo) CompareNew(w http.ResponseWriter, r *http.Request) { l := rp.logger.With("handler", "RepoCompareNew") @@ -132,6 +135,11 @@ func (rp *Repo) Compare(w http.ResponseWriter, r *http.Request) { return } + if shaPattern.MatchString(base) || shaPattern.MatchString(head) { + http.Error(w, "comparing by commit SHA is not allowed, use a branch or tag name", http.StatusForbidden) + return + } + scheme := "http" if !rp.config.Core.Dev { scheme = "https" -- 2.51.2