diff --git a/pkg/gitparse/gitparse.go b/pkg/gitparse/gitparse.go index a49fe5697..caa8066a3 100644 --- a/pkg/gitparse/gitparse.go +++ b/pkg/gitparse/gitparse.go @@ -17,8 +17,13 @@ import ( "github.com/trufflesecurity/trufflehog/v3/pkg/context" ) -// DateFormat is the standard date format for git. -const DateFormat = "Mon Jan 02 15:04:05 2006 -0700" +const ( + // DateFormat is the standard date format for git. + DateFormat = "Mon Jan 02 15:04:05 2006 -0700" + + // MaxDiffSize is the maximum size for a diff. Larger diffs will be cut off. + MaxDiffSize = 1 * 1024 * 1024 * 1024 // 1GB +) // Commit contains commit header info and diffs. type Commit struct { @@ -222,7 +227,10 @@ func FromReader(ctx context.Context, stdOut io.Reader, commitChan chan Commit) { } } } - + if currentDiff.Content.Len() > MaxDiffSize { + log.Debugf("Diff for %s exceeded MaxDiffSize(%d)", currentDiff.PathB, MaxDiffSize) + break + } } if currentDiff != nil && currentDiff.Content.Len() > 0 { currentCommit.Diffs = append(currentCommit.Diffs, *currentDiff) diff --git a/pkg/gitparse/gitparse_test.go b/pkg/gitparse/gitparse_test.go index 88ada0377..7bf75115d 100644 --- a/pkg/gitparse/gitparse_test.go +++ b/pkg/gitparse/gitparse_test.go @@ -181,6 +181,30 @@ func TestMultiCommitContextDiff(t *testing.T) { } } +func TestMaxDiffSize(t *testing.T) { + bigBytes := bytes.Buffer{} + bigBytes.WriteString(singleCommitSingleDiff) + for i := 0; i <= MaxDiffSize/1024+10; i++ { + bigBytes.WriteString("+") + for n := 0; n < 1024; n++ { + bigBytes.Write([]byte("0")) + } + bigBytes.WriteString("\n") + } + bigReader := bytes.NewReader(bigBytes.Bytes()) + + commitChan := make(chan Commit) + go func() { + FromReader(context.TODO(), bigReader, commitChan) + }() + + commit := <-commitChan + if commit.Diffs[0].Content.Len() > MaxDiffSize+1024 { + t.Errorf("diff did not match MaxDiffSize. Got: %d, expected (max): %d", commit.Diffs[0].Content.Len(), MaxDiffSize+1024) + } + +} + const singleCommitSingleDiff = `commit 70001020fab32b1fcf2f1f0e5c66424eae649826 (HEAD -> master, origin/master, origin/HEAD) Author: Dustin Decker Date: Mon Mar 15 23:27:16 2021 -0700