feat: update gitea vendor

package/gitea/source/modules/packages/arch/metadata.go

@@ -13,8 +13,9 @@ import (
 	"strconv"
 	"strings"
 
-	"code.gitea.io/gitea/modules/util"
-	"code.gitea.io/gitea/modules/validation"
+	"gitea.dev/modules/packages"
+	"gitea.dev/modules/util"
+	"gitea.dev/modules/validation"
 
 	"github.com/klauspost/compress/zstd"
 	"github.com/ulikunitz/xz"
@@ -46,6 +47,11 @@ var (
 	namePattern = regexp.MustCompile(`\A[a-zA-Z0-9@._+-]+\z`)
 	// (epoch:pkgver-pkgrel)
 	versionPattern = regexp.MustCompile(`\A(?:\d:)?[\w.+~]+(?:-[-\w.+~]+)?\z`)
+
+	// caps on the accumulated package file list (vars so tests can lower them); far above
+	// any legitimate package, but low enough to stop metadata amplification
+	maxFileEntries   = 100000
+	maxFileNameBytes = 16 * 1024 * 1024
 )
 
 type Package struct {
@@ -124,7 +130,7 @@ func ParsePackage(r io.Reader) (*Package, error) {
 	}
 
 	var p *Package
-	files := make([]string, 0, 10)
+	files := packages.NewBoundedFileList(maxFileEntries, maxFileNameBytes)
 
 	tr := tar.NewReader(inner)
 	for {
@@ -147,7 +153,12 @@ func ParsePackage(r io.Reader) (*Package, error) {
 				return nil, err
 			}
 		} else if !strings.HasPrefix(filename, ".") {
-			files = append(files, hd.Name)
+			if strings.ContainsAny(hd.Name, "\n\r") {
+				continue // a newline would forge extra lines in the pacman index
+			}
+			if err := files.Add(hd.Name); err != nil {
+				return nil, err
+			}
 		}
 	}
 
@@ -155,7 +166,7 @@ func ParsePackage(r io.Reader) (*Package, error) {
 		return nil, ErrMissingPKGINFOFile
 	}
 
-	p.FileMetadata.Files = files
+	p.FileMetadata.Files = files.Files()
 	p.FileCompressionExtension = compressionType
 
 	return p, nil