This is an automated email from the ASF dual-hosted git repository. juergbi pushed a commit to branch jbilleter/hash-validation in repository https://gitbox.apache.org/repos/asf/buildstream.git
commit 2dffadc0a2e60c21714f7b7acf9c2547db49913e Author: Jürg Billeter <[email protected]> AuthorDate: Fri Oct 9 18:16:29 2026 +0200 cascache: Validate hash before using it for a filesystem path --- src/buildstream/_cas/cascache.py | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/src/buildstream/_cas/cascache.py b/src/buildstream/_cas/cascache.py index 0db18dd4a..39dfa22da 100644 --- a/src/buildstream/_cas/cascache.py +++ b/src/buildstream/_cas/cascache.py @@ -16,6 +16,7 @@ import itertools import os +import re import stat import contextlib import time @@ -41,6 +42,10 @@ _BUFFER_SIZE = 65536 _CACHE_USAGE_REFRESH = 5 +# Constant for SHA-256 validation (64 hexadecimal digits) +_HASH_REGEX = re.compile(r"[0-9a-f]{64}") + + class CASLogLevel(FastEnum): WARNING = "warning" INFO = "info" @@ -323,6 +328,9 @@ class CASCache: # (str): The path of the object # def objpath(self, digest): + if not _HASH_REGEX.fullmatch(digest.hash): + raise ValueError(f"Invalid hash: `{digest.hash}`") + return os.path.join(self.casdir, "objects", digest.hash[:2], digest.hash[2:]) # open():
