fix: parse actor identities without regular expressions · gitpython-developers/GitPython@751473a · GitHub

gitpython-developers / GitPython Public

• Notifications You must be signed in to change notification settings
• Fork 989
• Star 5.2k

• Code
• Issues 8
• Pull requests 2
• Discussions
• Actions
• Security and quality 34
• Insights

Additional navigation options

Commit 751473a

Browse filesBrowse the repository at this point in the historyBrowse files

Byron

and

codex

committed

fix: parse actor identities without regular expressions

<!-- agent --> GHSA-g5vv-9gxw-82hx reports quadratic backtracking when an actor identity contains a long unterminated email delimiter. Add a regression that exercises a 20,000-character malformed identity, then replace both actor regexes with direct delimiter scans following Git's first-opening, first-closing delimiter behavior. Keep GitPython's whole-string fallback when either delimiter is absent. Reference Git baseline cf5497b14c5a24f10c13f7e0ee85cb95 ident.c::split_ident_line and its invalid-committer cases in t/t9300-fast-import.sh. Also reference gix-actor's signature decoder and lenient identity tests. Assisted-by: GPT 5.6 Co-authored-by: GPT 5.6 <codex@openai.com>

1 parent 9a92677 commit 751473a
Copy full SHA for 751473a

3 files changed

+41-16Lines changed: 41 additions & 16 deletions

File tree

Expand file treeCollapse file tree

Open diff view settings

Filter options

• doc/source
  • changes.rst
• git
  • util.py
• test
  • test_actor.py

Expand file treeCollapse file tree

Open diff view settings

Collapse file

‎doc/source/changes.rst‎

Copy file name to clipboardExpand all lines: doc/source/changes.rst

+13Lines changed: 13 additions & 0 deletions

• Display the source diff
• Display the rich diff

Original file line number	Diff line number	Diff line change
@@ -2,6 +2,19 @@
2	2	Changelog
3	3	=========
4	4
	5	+ 3.1.60
	6	+ ======
	7	+
	8	+ Security fixes for
	9	+
	10	+ * https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-g5vv-9gxw-82hx
	11	+
	12	+ If you can, also try and provide feedback on the upcoming v4 branch
	13	+ https://github.com/gitpython-developers/GitPython/pull/2177 - patches welcome.
	14	+
	15	+ See the following for all changes.
	16	+ https://github.com/gitpython-developers/GitPython/releases/tag/3.1.60
	17	+
5	18	3.1.59
6	19	======
7	20

Collapse file

‎git/util.py‎

Copy file name to clipboardExpand all lines: git/util.py

+8-16Lines changed: 8 additions & 16 deletions

Original file line number	Diff line number	Diff line change
@@ -858,10 +858,6 @@ class Actor:
858	858	committers and authors or anything with a name and an email as mentioned in the git
859	859	log entries."""
860	860
861		- # PRECOMPILED REGEX
862		- name_only_regex = re.compile(r"<(.*)>")
863		- name_email_regex = re.compile(r"(.*) <(.*?)>")
864		-
865	861	# ENVIRONMENT VARIABLES
866	862	# These are read when creating new commits.
867	863	env_author_name = "GIT_AUTHOR_NAME"
@@ -906,18 +902,14 @@ def _from_string(cls, string: str) -> "Actor":
906	902	:return:
907	903	:class:`Actor`
908	904	"""
909		- m = cls.name_email_regex.search(string)
910		- if m:
911		- name, email = m.groups()
912		- return Actor(name, email)
913		- else:
914		- m = cls.name_only_regex.search(string)
915		- if m:
916		- return Actor(m.group(1), None)
917		- # Assume the best and use the whole string as name.
918		- return Actor(string, None)
919		- # END special case name
920		- # END handle name/email matching
	905	+ line = string.partition("\n")[0]
	906	+ left_bracket = line.find("<")
	907	+ right_bracket = line.find(">", left_bracket + 1)
	908	+ if left_bracket >= 0 and right_bracket >= 0:
	909	+ return Actor(line[:left_bracket].rstrip(), line[left_bracket + 1 : right_bracket])
	910	+
	911	+ # Assume the best and use the whole string as name.
	912	+ return Actor(string, None)
921	913
922	914	@classmethod
923	915	def _main_actor(

Collapse file

‎test/test_actor.py‎

Copy file name to clipboardExpand all lines: test/test_actor.py

+20Lines changed: 20 additions & 0 deletions

Original file line number	Diff line number	Diff line change
@@ -27,6 +27,26 @@ def test_from_string_should_handle_just_name(self):
27	27	self.assertEqual("Michael Trier", a.name)
28	28	self.assertEqual(None, a.email)
29	29
	30	+ def test_from_string_handles_unterminated_email_without_regex_backtracking(self):
	31	+ value = "A" * 20_000 + " <unterminated"
	32	+ actor = Actor._from_string(value)
	33	+ self.assertNotIn("name_email_regex", vars(Actor))
	34	+ self.assertEqual(actor, Actor(value, None))
	35	+
	36	+ def test_from_string_does_not_parse_across_lines(self):
	37	+ self.assertEqual(Actor._from_string("x <a>\n y <b>"), Actor("x", "a"))
	38	+
	39	+ def test_from_string_uses_git_delimiters(self):
	40	+ for value, expected in (
	41	+ ("Name <e<mail>", Actor("Name", "e<mail")),
	42	+ ("Name <email>>", Actor("Name", "email")),
	43	+ ("Name<email>", Actor("Name", "email")),
	44	+ (" <>", Actor("", "")),
	45	+ ("Name <email", Actor("Name <email", None)),
	46	+ ("Name email>", Actor("Name email>", None)),
	47	+ ):
	48	+ self.assertEqual(Actor._from_string(value), expected)
	49	+
30	50	def test_should_display_representation(self):
31	51	a = Actor._from_string("Michael Trier <mtrier@example.com>")
32	52	self.assertEqual('<git.Actor "Michael Trier <mtrier@example.com>">', repr(a))

0 commit comments

Comments

0 (0)