Repository navigation
Close the Composer download gaps left after #430 - #433
Merged
Merged
Conversation
…e commit the lock file pins, and branch names with a slash are escaped in dist URLs so the download route matches them.
…it's URL are now discarded and fetched again, and a refetched artifact records the URL it actually came from.
… proxies cached under the shared archive.zip name is dropped. A test now moves the branch from A to B and checks that A keeps coming from the cache.
andrew
pushed a commit
that referenced
this pull request
Oct 12, 2026
* Reject package requests whose decoded path contains '?' or '#', in one middleware in front of every ecosystem mount. Handlers build the upstream URL from the decoded path, so busybox.apk%3F/foo-9.9-r0.apk fetched busybox but cached it as foo; PyPI could be poisoned the same way, and the other ecosystems stored files under mangled names past the denylist and cooldown. * Let Composer archive downloads through the '?'/'#' guard: they resolve the upstream URL from metadata, and with #433 a branch like dev-fix/#42 is requested as dev-fix%2F%2342. Adversarial review finding F1.
andrew
approved these changes
Oct 12, 2026
andrew
left a comment
andrew
left a comment
Contributor
There was a problem hiding this comment.
The commit-specific GitLab cache keys, stale archive replacement, and escaped branch versions address the linked issue. No changes requested.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #432.
GitLab archives are now cached per commit (
archive-<sha>.zip), and branch downloads fetch the commit from the lock file. The old sharedarchive.zipentry gets dropped.Archives cached under the wrong commit before #430 are fetched again when their stored upstream URL doesn't match. For that, a refetch now also updates
upstream_urlin the database.Branch names with a slash are escaped in dist URLs, so
dev-feature/xworks.Tested with a lock file pinning A while the branch moves to B, on GitHub and GitLab, with and without cache. I also ran the built proxy on SQLite and Postgres against old cache data from before #430.