fix: pass merge commit messages to git via stdin (#39269)

`git commit --message=` passes the merge message as a single argument,
which Linux caps at 128 KiB and Windows at 32 KiB for the whole command
line. Long messages failed with `argument list too long` and the merge
box toast showed the raw HTML 500 page.

Pass the message via `--file=-` on stdin instead, and answer
fetch-action requests with JSON on server errors so the toast shows the
error text. Limits merge commit messages to 512KB which could be
extended or made configurable later.

Fixes: https://github.com/go-gitea/gitea/issues/39261
Fixes: https://github.com/go-gitea/gitea/issues/30276
Signed-off-by: wxiaoguang <wxiaoguang@gmail.com>
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>

modules/git/commit.go

@@ -248,3 +248,14 @@ func GetFullCommitID(ctx context.Context, repo RepositoryFacade, shortID string)
 	}
 	return strings.TrimSpace(commitID), nil
 }
+
+func AddObjectMessageArgument(cmd *gitcmd.Command, typ ObjectType, message string) error {
+	if len(message) > 512*1024 {
+		// It doesn't make sense to store very large messages in git objects,
+		// and it never succeeded in the past due to the command line argument limit (e.g.: 128K on Linux).
+		// If any real world user would complain about the limit, let them explain why, then make the limit configurable.
+		return util.NewInvalidArgumentErrorf("git %s message is too long", typ)
+	}
+	cmd.AddArguments("--file=-").WithStdinBytes([]byte(message))
+	return nil
+}

modules/git/gitcmd/pipe.go

@@ -8,11 +8,6 @@ import (
 	"os"
 )
 
-type PipeBufferReader interface {
-	Read(p []byte) (n int, err error)
-	Bytes() []byte
-}
-
 type PipeBufferWriter interface {
 	Write(p []byte) (n int, err error)
 	Bytes() []byte

modules/git/repo_commit_nogogit.go

@@ -9,32 +9,10 @@ import (
 	"context"
 	"errors"
 	"io"
-	"strings"
 
-	"gitea.dev/modules/git/gitcmd"
-	"gitea.dev/modules/log"
+	"gitea.dev/modules/setting"
 )
 
-// ResolveReference resolves a name to a reference
-func (repo *Repository) ResolveReference(ctx context.Context, name string) (string, error) {
-	stdout, _, err := gitcmd.NewCommand("show-ref", "--hash").
-		AddDynamicArguments(name).
-		WithRepo(repo).
-		RunStdString(ctx)
-	if err != nil {
-		if strings.Contains(err.Error(), "not a valid ref") {
-			return "", ErrNotExist{name, ""}
-		}
-		return "", err
-	}
-	stdout = strings.TrimSpace(stdout)
-	if stdout == "" {
-		return "", ErrNotExist{name, ""}
-	}
-
-	return stdout, nil
-}
-
 // GetRefCommitID returns the last commit ID string of given reference (branch or tag).
 func (repo *Repository) GetRefCommitID(ctx context.Context, name string) (string, error) {
 	batch, cancel, err := repo.CatFileBatch()
@@ -60,6 +38,15 @@ func (repo *Repository) getCommit(ctx context.Context, id ObjectID) (*Commit, er
 	return repo.getCommitWithBatch(batch, id)
 }
 
+func limitDiscardReader(rd BufferedReader, full, limit int64) (io.Reader, func() error) {
+	return io.LimitReader(rd, min(full, limit)), func() error {
+		if full > limit {
+			return DiscardFull(rd, full-limit)
+		}
+		return nil
+	}
+}
+
 func (repo *Repository) getCommitWithBatch(batch CatFileBatch, id ObjectID) (*Commit, error) {
 	info, rd, err := batch.QueryContent(id.String())
 	if err != nil {
@@ -73,12 +60,14 @@ func (repo *Repository) getCommitWithBatch(batch CatFileBatch, id ObjectID) (*Co
 	case "missing":
 		return nil, ErrNotExist{ID: id.String()}
 	case "tag":
-		// then we need to parse the tag
-		// and load the commit
-		data, err := io.ReadAll(io.LimitReader(rd, info.Size))
+		limitReader, limitDiscard := limitDiscardReader(rd, info.Size, MaxGitObjectSize)
+		data, err := io.ReadAll(limitReader)
 		if err != nil {
 			return nil, err
 		}
+		if err = limitDiscard(); err != nil {
+			return nil, err
+		}
 		_, err = rd.Discard(1)
 		if err != nil {
 			return nil, err
@@ -89,10 +78,14 @@ func (repo *Repository) getCommitWithBatch(batch CatFileBatch, id ObjectID) (*Co
 		}
 		return repo.getCommitWithBatch(batch, tag.Object)
 	case "commit":
-		commit, err := CommitFromReader(id, io.LimitReader(rd, info.Size))
+		limitReader, limitDiscard := limitDiscardReader(rd, info.Size, MaxGitObjectSize)
+		commit, err := CommitFromReader(id, limitReader)
 		if err != nil {
 			return nil, err
 		}
+		if err = limitDiscard(); err != nil {
+			return nil, err
+		}
 		_, err = rd.Discard(1)
 		if err != nil {
 			return nil, err
@@ -100,7 +93,9 @@ func (repo *Repository) getCommitWithBatch(batch CatFileBatch, id ObjectID) (*Co
 
 		return commit, nil
 	default:
-		log.Debug("Unknown cat-file object type: %s", info.Type)
+		if info.Type != "blob" && info.Type != "tree" {
+			setting.PanicInDevOrTesting("Unknown cat-file object type %s for object %s in repo %s", info.Type, id.String(), repo.LogString())
+		}
 		if err := DiscardFull(rd, info.Size+1); err != nil {
 			return nil, err
 		}

modules/git/repo_index.go

@@ -73,12 +73,6 @@ func (repo *Repository) ReadTreeToTemporaryIndex(ctx context.Context, treeish st
 	return tmpIndexFilename, tmpDir, cancel, nil
 }
 
-// EmptyIndex empties the index
-func (repo *Repository) EmptyIndex(ctx context.Context) error {
-	_, _, err := gitcmd.NewCommand("read-tree", "--empty").WithRepo(repo).RunStdString(ctx)
-	return err
-}
-
 // LsFiles checks if the given filenames are in the index
 func (repo *Repository) LsFiles(ctx context.Context, filenames ...string) ([]string, error) {
 	cmd := gitcmd.NewCommand("ls-files", "-z").AddDashesAndList(filenames...)

modules/git/repo_object.go

@@ -11,6 +11,10 @@ import (
 	"gitea.dev/modules/git/gitcmd"
 )
 
+// MaxGitObjectSize is used to avoid OOM when reading a large git object.
+// GitHub has a limit (100M) for pushing, but Gitea doesn't have such a limit yet.
+var MaxGitObjectSize int64 = 100 * 1024 * 1024
+
 // ObjectType git object type
 type ObjectType string
 

modules/git/repo_tag.go

@@ -27,11 +27,11 @@ func (repo *Repository) CreateTag(ctx context.Context, name, revision string) er
 
 // CreateAnnotatedTag create one annotated tag in the repository
 func (repo *Repository) CreateAnnotatedTag(ctx context.Context, name, message, revision string) error {
-	_, _, err := gitcmd.NewCommand("tag", "-a", "-m").
-		AddDynamicArguments(message).
-		AddDashesAndList(name, revision).
-		WithRepo(repo).
-		RunStdString(ctx)
+	cmd := gitcmd.NewCommand("tag", "--annotate")
+	if err := AddObjectMessageArgument(cmd, ObjectTag, message); err != nil {
+		return err
+	}
+	_, _, err := cmd.AddDashesAndList(name, revision).WithRepo(repo).RunStdString(ctx)
 	return err
 }
 

modules/git/repo_tag_nogogit.go

@@ -106,12 +106,15 @@ func (repo *Repository) getTag(ctx context.Context, tagID ObjectID, name string)
 		return nil, ErrNotExist{ID: tagID.String()}
 	}
 
-	// then we need to parse the tag
-	// and load the commit
-	data, err := io.ReadAll(io.LimitReader(rd, size))
+	// then we need to parse the tag and load the commit
+	limitReader, limitDiscard := limitDiscardReader(rd, info.Size, MaxGitObjectSize)
+	data, err := io.ReadAll(limitReader)
 	if err != nil {
 		return nil, err
 	}
+	if err = limitDiscard(); err != nil {
+		return nil, err
+	}
 	_, err = rd.Discard(1)
 	if err != nil {
 		return nil, err

modules/httplib/server_request.go

@@ -5,6 +5,8 @@ package httplib
 
 import (
 	"context"
+	"errors"
+	"io"
 	"net"
 	"net/http"
 	"net/url"
@@ -240,3 +242,28 @@ func ParseGiteaSiteURL(ctx context.Context, s string) *GiteaSiteURL {
 	}
 	return ret
 }
+
+func IsGiteaFetchActionRequest(req *http.Request) bool {
+	return req.Header.Get("X-Gitea-Fetch-Action") != ""
+}
+
+func IsClientOrNetworkError(ctx context.Context, err error) bool {
+	if err == nil {
+		return false
+	}
+
+	if ctx.Err() != nil || errors.Is(err, context.Canceled) || errors.Is(err, context.DeadlineExceeded) {
+		return true
+	}
+
+	// client request corrupted (e.g.: Content-Length is sent but body is incomplete)
+	if errors.Is(err, io.ErrUnexpectedEOF) {
+		return true
+	}
+
+	// network error
+	if _, ok := errors.AsType[net.Error](err); ok {
+		return true
+	}
+	return false
+}

modules/web/middleware/cookie.go

@@ -9,6 +9,7 @@ import (
 	"net/url"
 	"strings"
 
+	"gitea.dev/modules/httplib"
 	"gitea.dev/modules/session"
 	"gitea.dev/modules/setting"
 	"gitea.dev/modules/util"
@@ -35,7 +36,7 @@ func DeleteRedirectToCookie(resp http.ResponseWriter) {
 }
 
 func RedirectLinkUserLogin(req *http.Request) string {
-	if req.Header.Get("X-Gitea-Fetch-Action") != "" {
+	if httplib.IsGiteaFetchActionRequest(req) {
 		// when building the redirect link for a fetch request, the current link might be a partial page,
 		// so we only redirect to the login page without redirect_to parameter
 		return setting.AppSubURL + "/user/login"