From 2dffadc0a2e60c21714f7b7acf9c2547db49913e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?J=C3=BCrg=20Billeter?= <j@bitron.ch>
Date: Fri, 9 Oct 2026 18:16:29 +0200
Subject: [PATCH] cascache: Validate hash before using it for a filesystem path

---
 src/buildstream/_cas/cascache.py | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/src/buildstream/_cas/cascache.py b/src/buildstream/_cas/cascache.py
index 0db18dd4a..39dfa22da 100644
--- a/src/buildstream/_cas/cascache.py
+++ b/src/buildstream/_cas/cascache.py
@@ -16,6 +16,7 @@
 
 import itertools
 import os
+import re
 import stat
 import contextlib
 import time
@@ -41,6 +42,10 @@
 _CACHE_USAGE_REFRESH = 5
 
 
+# Constant for SHA-256 validation (64 hexadecimal digits)
+_HASH_REGEX = re.compile(r"[0-9a-f]{64}")
+
+
 class CASLogLevel(FastEnum):
     WARNING = "warning"
     INFO = "info"
@@ -323,6 +328,9 @@ def pull_tree(self, remote, digest):
     #     (str): The path of the object
     #
     def objpath(self, digest):
+        if not _HASH_REGEX.fullmatch(digest.hash):
+            raise ValueError(f"Invalid hash: `{digest.hash}`")
+
         return os.path.join(self.casdir, "objects", digest.hash[:2], digest.hash[2:])
 
     # open():