ref-utils: Make remote name validation public and take an error

We should be consistent with the validation in the session-helper, so
let's make this validation function available to it.

Helps: https://github.com/flatpak/flatpak/security/advisories/GHSA-v2gw-v9h5-9q4x
This commit is contained in:
Sebastian Wick committed 2026-08-10 23:06:17 +02:00
1 parent d3398edf3e
commit e04fb5677a
2 files changed
+35 -15

No files matched your search

+3
View File
@@ -33,6 +33,9 @@ gboolean flatpak_is_valid_branch (const char *string,
gboolean flatpak_is_valid_arch (const char *string,
gssize len,
GError **error);
gboolean flatpak_is_valid_remote_name (const char *string,
gssize len,
GError **error);
gboolean flatpak_has_name_prefix (const char *string,
const char *name);
gboolean flatpak_name_matches_one_wildcard_prefix (const char *string,
+32 -15
View File
@@ -567,25 +567,42 @@ is_valid_remote_name_character (gint c)
c == '.';
}
static gboolean
is_valid_remote_name (const char *remote,
gsize len)
gboolean
flatpak_is_valid_remote_name (const char *string,
gssize len,
GError **error)
{
const char *end;
if (len == 0)
return FALSE;
if (len < 0)
len = strlen (string);
end = remote + len;
if (!is_valid_initial_remote_name_character (*remote++))
return FALSE;
while (remote < end)
if (G_UNLIKELY (len == 0))
{
char c = *remote++;
if (!is_valid_remote_name_character (c))
return FALSE;
flatpak_fail_error (error, FLATPAK_ERROR_INVALID_NAME,
_("Remote name can't be empty"));
return FALSE;
}
end = string + len;
if (G_UNLIKELY (!is_valid_initial_remote_name_character (*string)))
{
flatpak_fail_error (error, FLATPAK_ERROR_INVALID_NAME,
_("Remote name can't start with %c"), *string);
return FALSE;
}
string++;
while (string < end)
{
if (G_UNLIKELY (!is_valid_remote_name_character (*string)))
{
flatpak_fail_error (error, FLATPAK_ERROR_INVALID_NAME,
_("Remote name can't contain %c"), *string);
return FALSE;
}
string++;
}
return TRUE;
@@ -622,7 +639,7 @@ _flatpak_decomposed_new (char *ref,
const char *colon = strchr (p, ':');
if (colon != NULL)
{
if (!is_valid_remote_name (ref, colon - ref))
if (!flatpak_is_valid_remote_name (ref, colon - ref, NULL))
{
flatpak_fail_error (error, FLATPAK_ERROR_INVALID_REF, _("Invalid remote name"));
return NULL;