Skip to content

fix: 主题包校验 gzip 校验和,被改过的包不再能装上 - #64

Merged
stqfdyr merged 1 commit into
mainfrom
fix/theme-gzip-checksum
Sep 24, 2026
Merged

stqfdyr merged 1 commit into
mainfrom
fix/theme-gzip-checksum

Conversation

@stqfdyr

@stqfdyr stqfdyr commented Sep 24, 2026 •

Copy link
Copy Markdown
Collaborator

tar 读到结束块就停,读不到 gzip 尾部的校验和。中途被改过字节的包,或者只丢了结束块之后几个字节的包,每个条目都读得出来,照样能装上。

  • 解压完把压缩流读到底,校验和不对时给出与截断包相同的提示「主题包损坏或不完整(可能没下载完),重新下载 theme.tar.gz 再试」,原文进日志
  • 结束块之后只允许 1 MiB 的填充(tar 默认补到 10 KiB),超过时拒绝。不设上限时塞在后面的零按每 MiB 上传 1 GiB 解压的比例空耗 CPU,实测 1 MiB 的包要 1.37 秒,32 MiB 上限约 40 秒;一键更新第三方主题同样会触发

测试

  • cargo fmt --check、cargo clippy --all-targets、cargo test(126 个)通过
  • 新增用例:截掉末尾 4 字节、改动校验和的 1 个字节,两个包都被拒,去掉这行读取后这两个用例失败;结束块之后跟着 1 MiB + 1 字节的零被拒
  • 临时 hub 实测:Glassmorphism 1.0.0–1.0.2、默认主题 1.1.0、serverstatus 1.2.0 照常安装;结束块之后 1 GiB 零的包 12 毫秒内被拒

@stqfdyr
stqfdyr force-pushed the fix/theme-gzip-checksum branch from 7f92941 to 758fb25 Compare September 24, 2026 19:14
Base automatically changed from fix/error-messages to main September 24, 2026 19:18
tar 读到结束块就停,读不到 gzip 尾部的校验和:中途被改过字节、或者只丢了
结束块之后几个字节的包,每个条目都读得出来,照样装上。解压完把压缩流读到底,
校验和不对时给出与截断包相同的「主题包损坏或不完整」。

结束块之后只允许 1 MiB 的填充:不设上限时,塞在后面的零会以每 MiB 上传
1 GiB 解压的比例空耗 CPU。
@stqfdyr
stqfdyr force-pushed the fix/theme-gzip-checksum branch from 758fb25 to 139d1da Compare September 24, 2026 19:18
@stqfdyr
stqfdyr merged commit fb4c4a4 into main Sep 24, 2026
1 check passed
@stqfdyr
stqfdyr deleted the fix/theme-gzip-checksum branch September 24, 2026 19:21
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant