{{ message }}
Commit 81ef4cb
fix: parse actor identities without regular expressions
GHSA-g5vv-9gxw-82hx reports quadratic backtracking when an actor
identity contains a long unterminated email delimiter.
Add a regression that exercises a 20,000-character malformed identity,
then replace both actor regexes with direct delimiter scans. This keeps
the existing well-formed, multiline, and fallback results while making
the work linear in input length.
Reference Git baseline cf5497b14c5a24f10c13f7e0ee85cb95
ident.c::split_ident_line and its invalid-committer cases in
t/t9300-fast-import.sh. Also reference gix-actor's signature decoder and
lenient identity tests.
Validation:
- test/test_actor.py: 6 passed
- TestUtils::test_actor_from_string passes
- ruff check and format pass1 parent 72a2b06 commit 81ef4cb
2 files changed
Lines changed: 25 additions & 16 deletions

0 commit comments