Skip to content

Commenting on a diff of a file with spaces separating short tokens makes the PR page inaccessible #14812

@abread

Description

@abread

Rendering the PR page errors with template: repo/issue/view_content/comments:470:20: executing "repo/issue/view_content/comments" at <CommentMustAsDiff (index $comms 0)>: error calling CommentMustAsDiff: runtime error: slice bounds out of range [2:1]

I was unable to get a proper stacktrace (or logs), but I manually traced the offending slice indexing to this line.

The git-diff output filename extractor (readFileName) cannot properly split the old name from the new name (and panics because instead of finding b/<filename> to remove b/ it finds the single letter bit of the old filename).

git-diff outputs unquoted paths because Gitea sets core.quotePath (git config) to false. Interestingly, readFileName has code handling quoted paths already. It did work too when I changed the offending patch in the comments table to have quoted paths.

Steps to reproduce:

  1. Open a PR creating a file whose name is something like sdafdsaf z 1 - the first document.txt (anything in the format<any amount of characters that are not a space> <1 non-space character>[ <anything>] works as far as I can tell)
  2. Comment on any line of this new file in the PR
  3. The conversation tab of this PR now gives a 500 error when accessed

Fix suggestion

Maybe there's a really good reason to keep it, but imho leaving all paths returned by git quoted (core.quotePath=true) is the best option for sane path handling everywhere.

It may already be ok to do so: setting it to true didn't break any tests on my machine at least.

  • Gitea version (or commit ref): 1.13.2
  • Git version: 2.26.2
  • Operating system: Gentoo
    • using official ebuild with USE="acct build-client filecaps pam -sqlite"
    • started by OpenRC
  • Database (use [x]):
    • PostgreSQL
    • MySQL
    • MSSQL
    • SQLite (also tested)
  • Can you reproduce the bug at https://try.gitea.io:
  • Log gist: no logs appear (not even with Trace everything)

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions