Merge branch 'main' of https://github.com/jescalada/git-proxy-security-fixes

Author: jescalada

.github/workflows/ci.yml

@@ -30,6 +30,8 @@ jobs:
 
     - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
       with:
+        repository: jescalada/git-proxy-security-fixes
+        token: ${{ secrets.PAT_TOKEN }}
         fetch-depth: 0
 
     - name: Use Node.js ${{ matrix.node-version }}

src/proxy/processors/constants.ts

@@ -0,0 +1,6 @@
+export const BRANCH_PREFIX = 'refs/heads/';
+export const EMPTY_COMMIT_HASH = '0000000000000000000000000000000000000000';
+export const FLUSH_PACKET = '0000';
+export const PACK_SIGNATURE = 'PACK';
+export const PACKET_SIZE = 4;
+export const GIT_OBJECT_TYPE_COMMIT = 1;

src/proxy/processors/push-action/getDiff.ts

@@ -1,6 +1,8 @@
 import { Action, Step } from '../../actions';
 import simpleGit from 'simple-git';
 
+import { EMPTY_COMMIT_HASH } from '../constants';
+
 const exec = async (req: any, action: Action): Promise<Action> => {
   const step = new Step('diff');
 
@@ -11,11 +13,15 @@ const exec = async (req: any, action: Action): Promise<Action> => {
     let commitFrom = `4b825dc642cb6eb9a060e54bf8d69288fbee4904`;
 
     if (!action.commitData || action.commitData.length === 0) {
-      throw new Error('No commit data found');
+      step.error = true;
+      step.log('No commitData found');
+      step.setError('Your push has been blocked because no commit data was found.');
+      action.addStep(step);
+      return action;
     }
 
-    if (action.commitFrom === '0000000000000000000000000000000000000000') {
-      if (action.commitData[0].parent !== '0000000000000000000000000000000000000000') {
+    if (action.commitFrom === EMPTY_COMMIT_HASH) {
+      if (action.commitData[0].parent !== EMPTY_COMMIT_HASH) {
         commitFrom = `${action.commitData[action.commitData.length - 1].parent}`;
       }
     } else {