Giteabot 9b8bfdceb1 fix: bound debian ParseControlFile to a single control stanza (#38044) (#38055) ...

Backport #38044 by @metsw24-max

**Packages-index stanza injection via Debian control file**

A `.deb` whose `control` file appends extra paragraphs after a blank
line was still accepted, and `ParseControlFile` stored the whole
multi-stanza blob in `p.Control`. That blob is re-emitted verbatim into
the generated `Packages` index, so the embedded blank line splits it
into separate stanzas and an uploader can smuggle a package entry with
an attacker-chosen `Filename` into the shared index. A binary control
file only holds one stanza, so parsing now stops at the blank line that
terminates it; well-formed packages are unaffected and the new subtest
covers the trailing-stanza case.

Signed-off-by: wxiaoguang <wxiaoguang@gmail.com>
Co-authored-by: metsw24-max <metsw24@gmail.com>
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
Co-authored-by: bircni <bircni@icloud.com>

2026-06-14 14:29:27 +00:00

..

alpine

…

arch

Relax the version checking for Arch packages (#32908)

2024-12-19 09:41:23 +00:00

cargo

cargo registry - respect renamed dependencies (#32430)

2024-11-12 02:57:30 +00:00

chef

…

composer

Make composer registry support tar.gz and tar.bz2 and fix bugs (#35958)

2025-11-18 23:15:50 +00:00

conan

Enable tenv and testifylint rules (#32852)

2024-12-15 10:41:29 +00:00

conda

Refactor error system (#33771)

2025-03-03 05:36:10 +00:00

container

use experimental go json v2 library (#35392)

2025-09-28 08:03:36 +00:00

cran

Fix CRAN package version validation to allow more than 4 version components (#36813)

2026-03-04 01:56:38 +08:00

debian

fix: bound debian ParseControlFile to a single control stanza (#38044) (#38055)

2026-06-14 14:29:27 +00:00

goproxy

Enable addtional linters (#34085)

2025-04-01 10:14:01 +00:00

helm

…

maven

Fix maven pom inheritance (#32943)

2024-12-25 04:28:37 +00:00

npm

Fix various bugs (#36139)

2025-12-12 18:56:05 +00:00

nuget

Fix NuGet package upload error handling (#37074)

2026-04-01 23:54:14 +00:00

pub

Limit reading bytes instead of ReadAll (#35928)

2025-11-12 19:44:49 +08:00

pypi

…

rpm

Add support for RPM Errata (updateinfo.xml) (#37125)

2026-04-08 00:39:53 +08:00

rubygems

Fix various version parsing problems (#36553)

2026-02-08 20:25:30 +00:00

swift

Swift registry metadata: preserve more JSON fields and accept empty metadata (#37254) (#37261)

2026-04-17 23:36:48 +02:00

terraform

Add terraform state registry (#36710)

2026-04-06 13:41:17 -07:00

vagrant

…

content_store.go

Refactor storage content-type handling of ServeDirectURL (#36804)

2026-03-21 21:26:13 -07:00

hashed_buffer_test.go

Uniform all temporary directories and allow customizing temp path (#32352)

2025-04-08 16:15:28 +00:00

hashed_buffer.go

Uniform all temporary directories and allow customizing temp path (#32352)

2025-04-08 16:15:28 +00:00

multi_hasher_test.go

…

multi_hasher.go

…