302 lines
10 KiB
Python
302 lines
10 KiB
Python
#!/usr/bin/env python3
|
|
"""NUL-safe, mode-aware Git change records and snapshot helpers."""
|
|
from __future__ import annotations
|
|
|
|
import argparse
|
|
import json
|
|
import os
|
|
import posixpath
|
|
import re
|
|
import subprocess
|
|
import unicodedata
|
|
from dataclasses import asdict, dataclass
|
|
from pathlib import Path, PurePosixPath
|
|
|
|
|
|
RAW_HEADER = re.compile(
|
|
rb"^:([0-7]{6}) ([0-7]{6}) ([0-9a-f]+) ([0-9a-f]+) ([A-Z])([0-9]*)$"
|
|
)
|
|
SAFE_BLOB_MODES = {"100644"}
|
|
SUPPORTED_STATUSES = {"A", "C", "D", "M", "R", "T"}
|
|
|
|
|
|
@dataclass(frozen=True)
|
|
class ChangeRecord:
|
|
status: str
|
|
old_path: str | None
|
|
new_path: str | None
|
|
old_mode: str
|
|
new_mode: str
|
|
old_oid: str
|
|
new_oid: str
|
|
similarity: int | None = None
|
|
|
|
def to_dict(self) -> dict[str, object]:
|
|
return asdict(self)
|
|
|
|
|
|
@dataclass(frozen=True)
|
|
class TreeEntry:
|
|
path: str
|
|
mode: str
|
|
object_type: str
|
|
oid: str
|
|
|
|
|
|
def _run_git(repo: str | Path, args: list[str], *, input_bytes: bytes | None = None) -> bytes:
|
|
result = subprocess.run(
|
|
["git", *args],
|
|
cwd=str(repo),
|
|
input=input_bytes,
|
|
stdout=subprocess.PIPE,
|
|
stderr=subprocess.PIPE,
|
|
check=False,
|
|
)
|
|
if result.returncode != 0:
|
|
message = result.stderr.decode("utf-8", "replace").strip()
|
|
raise RuntimeError(message or f"git {' '.join(args)} failed ({result.returncode})")
|
|
return result.stdout
|
|
|
|
|
|
def resolve_commit(repo: str | Path, ref: str) -> str:
|
|
value = _run_git(repo, ["rev-parse", "--verify", f"{ref}^{{commit}}"]).strip().decode("ascii")
|
|
if not re.fullmatch(r"[0-9a-f]{40}|[0-9a-f]{64}", value):
|
|
raise RuntimeError(f"Git returned a non-full commit object ID for {ref!r}")
|
|
return value
|
|
|
|
|
|
def resolve_merge_base(repo: str | Path, base_ref: str, head_ref: str) -> str:
|
|
value = _run_git(repo, ["merge-base", base_ref, head_ref]).strip().decode("ascii")
|
|
if not re.fullmatch(r"[0-9a-f]{40}|[0-9a-f]{64}", value):
|
|
raise RuntimeError(f"Git returned a non-full merge base for {base_ref!r} and {head_ref!r}")
|
|
return value
|
|
|
|
|
|
def parse_raw_diff(payload: bytes) -> list[ChangeRecord]:
|
|
"""Parse ``git diff --raw -z`` without interpreting path bytes as separators."""
|
|
if not payload:
|
|
return []
|
|
fields = payload.split(b"\0")
|
|
if fields[-1] != b"":
|
|
raise ValueError("raw Git diff is not NUL terminated")
|
|
fields.pop()
|
|
records: list[ChangeRecord] = []
|
|
index = 0
|
|
while index < len(fields):
|
|
match = RAW_HEADER.fullmatch(fields[index])
|
|
if not match:
|
|
raise ValueError(f"malformed raw Git diff header at field {index}")
|
|
index += 1
|
|
old_mode, new_mode, old_oid, new_oid, status_raw, similarity_raw = match.groups()
|
|
if len(old_oid) not in {40, 64} or len(new_oid) != len(old_oid):
|
|
raise ValueError("raw Git diff contains a truncated or mixed-width object ID")
|
|
status = status_raw.decode("ascii")
|
|
if status not in SUPPORTED_STATUSES:
|
|
raise ValueError(f"unsupported raw Git diff status {status!r}")
|
|
if status in {"R", "C"}:
|
|
if not similarity_raw or int(similarity_raw) > 100:
|
|
raise ValueError(f"raw Git {status} record has invalid similarity")
|
|
elif similarity_raw:
|
|
raise ValueError(f"raw Git {status} record unexpectedly has similarity")
|
|
path_count = 2 if status in {"R", "C"} else 1
|
|
if index + path_count > len(fields):
|
|
raise ValueError("raw Git diff ended before all path fields")
|
|
decoded = [field.decode("utf-8", "surrogateescape") for field in fields[index : index + path_count]]
|
|
if any(not path for path in decoded):
|
|
raise ValueError("raw Git diff contains an empty path")
|
|
index += path_count
|
|
old_path = decoded[0] if status != "A" else None
|
|
new_path = decoded[-1] if status != "D" else None
|
|
records.append(
|
|
ChangeRecord(
|
|
status=status,
|
|
old_path=old_path,
|
|
new_path=new_path,
|
|
old_mode=old_mode.decode("ascii"),
|
|
new_mode=new_mode.decode("ascii"),
|
|
old_oid=old_oid.decode("ascii"),
|
|
new_oid=new_oid.decode("ascii"),
|
|
similarity=int(similarity_raw) if similarity_raw else None,
|
|
)
|
|
)
|
|
return records
|
|
|
|
|
|
def read_change_records(
|
|
repo: str | Path,
|
|
base_ref: str,
|
|
head_ref: str,
|
|
*,
|
|
merge_base: bool = True,
|
|
) -> tuple[str, str, list[ChangeRecord]]:
|
|
"""Return immutable endpoints and their complete raw change records.
|
|
|
|
``merge_base=True`` is the PR evidence mode. ``False`` is the explicit
|
|
base/head security mode and resolves both endpoints directly.
|
|
"""
|
|
head_oid = resolve_commit(repo, head_ref)
|
|
base_oid = resolve_merge_base(repo, base_ref, head_oid) if merge_base else resolve_commit(repo, base_ref)
|
|
payload = _run_git(
|
|
repo,
|
|
[
|
|
"diff",
|
|
"--raw",
|
|
"--no-abbrev",
|
|
"-z",
|
|
"-M",
|
|
"--find-copies-harder",
|
|
base_oid,
|
|
head_oid,
|
|
"--",
|
|
],
|
|
)
|
|
return base_oid, head_oid, parse_raw_diff(payload)
|
|
|
|
|
|
def read_blob(repo: str | Path, oid: str) -> bytes:
|
|
if not re.fullmatch(r"[0-9a-f]{40}|[0-9a-f]{64}", oid):
|
|
raise ValueError("blob object ID must be a full hexadecimal object ID")
|
|
return _run_git(repo, ["cat-file", "blob", oid])
|
|
|
|
|
|
def read_path(repo: str | Path, commit_oid: str, path: str) -> bytes | None:
|
|
encoded_path = path.encode("utf-8", "surrogateescape")
|
|
spec = commit_oid.encode("ascii") + b":" + encoded_path
|
|
result = subprocess.run(
|
|
["git", "cat-file", "blob", spec],
|
|
cwd=str(repo),
|
|
stdout=subprocess.PIPE,
|
|
stderr=subprocess.PIPE,
|
|
check=False,
|
|
)
|
|
if result.returncode == 0:
|
|
return result.stdout
|
|
return None
|
|
|
|
|
|
def list_tree(repo: str | Path, commit_oid: str, prefix: str) -> list[TreeEntry]:
|
|
raw = _run_git(repo, ["ls-tree", "-r", "-z", "--full-tree", commit_oid, "--", prefix])
|
|
entries: list[TreeEntry] = []
|
|
for item in raw.split(b"\0"):
|
|
if not item:
|
|
continue
|
|
metadata, separator, path_bytes = item.partition(b"\t")
|
|
if not separator:
|
|
raise ValueError("malformed ls-tree record")
|
|
mode, object_type, oid = metadata.decode("ascii").split(" ", 2)
|
|
entries.append(
|
|
TreeEntry(
|
|
path=path_bytes.decode("utf-8", "surrogateescape"),
|
|
mode=mode,
|
|
object_type=object_type,
|
|
oid=oid,
|
|
)
|
|
)
|
|
return entries
|
|
|
|
|
|
def validate_repo_path(path: str) -> str | None:
|
|
if not path or path.startswith("/") or "\\" in path or "\x00" in path:
|
|
return "path is absolute, empty, contains NUL, or contains a literal backslash"
|
|
if any(unicodedata.category(character) in {"Cc", "Cs"} for character in path):
|
|
return "path contains a control character or invalid UTF-8 byte"
|
|
normalized = posixpath.normpath(path)
|
|
if normalized != path or normalized == ".." or normalized.startswith("../"):
|
|
return "path is not a normalized repository-relative path"
|
|
return None
|
|
|
|
|
|
def materialize_tree(
|
|
repo: str | Path,
|
|
commit_oid: str,
|
|
prefix: str,
|
|
destination: str | Path,
|
|
) -> list[dict[str, str]]:
|
|
"""Materialize regular non-executable blobs; report every unsafe entry."""
|
|
root = Path(destination).resolve()
|
|
root.mkdir(parents=True, exist_ok=True, mode=0o700)
|
|
unsafe: list[dict[str, str]] = []
|
|
prefix_root = PurePosixPath(prefix)
|
|
for entry in list_tree(repo, commit_oid, prefix):
|
|
reason = validate_repo_path(entry.path)
|
|
try:
|
|
relative = PurePosixPath(entry.path).relative_to(prefix_root)
|
|
except ValueError:
|
|
reason = reason or "tree entry is outside the requested prefix"
|
|
relative = None
|
|
if entry.object_type != "blob":
|
|
reason = reason or f"unsupported Git object type {entry.object_type}"
|
|
if entry.mode not in SAFE_BLOB_MODES:
|
|
mode_kind = {
|
|
"100755": "executable file",
|
|
"120000": "symlink",
|
|
"160000": "gitlink",
|
|
}.get(entry.mode, "unrecognized mode")
|
|
reason = reason or f"unsafe {mode_kind} ({entry.mode})"
|
|
if reason or relative is None or not relative.parts:
|
|
unsafe.append(
|
|
{
|
|
"path": entry.path,
|
|
"mode": entry.mode,
|
|
"oid": entry.oid,
|
|
"reason": reason or "unsafe tree entry",
|
|
}
|
|
)
|
|
continue
|
|
|
|
target = root.joinpath(*relative.parts)
|
|
target.parent.mkdir(parents=True, exist_ok=True, mode=0o700)
|
|
resolved_parent = target.parent.resolve()
|
|
try:
|
|
resolved_parent.relative_to(root)
|
|
except ValueError:
|
|
unsafe.append(
|
|
{
|
|
"path": entry.path,
|
|
"mode": entry.mode,
|
|
"oid": entry.oid,
|
|
"reason": "destination escapes snapshot root",
|
|
}
|
|
)
|
|
continue
|
|
flags = os.O_WRONLY | os.O_CREAT | os.O_EXCL
|
|
if hasattr(os, "O_NOFOLLOW"):
|
|
flags |= os.O_NOFOLLOW
|
|
descriptor = os.open(target, flags, 0o600)
|
|
try:
|
|
with os.fdopen(descriptor, "wb", closefd=False) as handle:
|
|
handle.write(read_blob(repo, entry.oid))
|
|
finally:
|
|
os.close(descriptor)
|
|
return sorted(unsafe, key=lambda item: (item["path"], item["mode"], item["oid"], item["reason"]))
|
|
|
|
|
|
def main() -> int:
|
|
parser = argparse.ArgumentParser(description="Emit complete mode-aware Git change records.")
|
|
parser.add_argument("--repo", default=".")
|
|
parser.add_argument("--base", required=True)
|
|
parser.add_argument("--head", required=True)
|
|
parser.add_argument("--mode", choices=("merge-base", "explicit"), default="merge-base")
|
|
args = parser.parse_args()
|
|
base_oid, head_oid, records = read_change_records(
|
|
args.repo, args.base, args.head, merge_base=args.mode == "merge-base"
|
|
)
|
|
print(
|
|
json.dumps(
|
|
{
|
|
"schema_version": 1,
|
|
"mode": args.mode,
|
|
"base_oid": base_oid,
|
|
"head_oid": head_oid,
|
|
"changes": [record.to_dict() for record in records],
|
|
},
|
|
indent=2,
|
|
sort_keys=True,
|
|
)
|
|
)
|
|
return 0
|
|
|
|
|
|
if __name__ == "__main__":
|
|
raise SystemExit(main())
|