Merge pull request #19621 from abitrolly/create-url-not-file

create: check that downloaded URL is actually archive
2025-03-28 08:52:00 +00:00 · 2025-03-28 08:52:00 +00:00 · 7b2ca65eac
commit 7b2ca65eac
parent 2603401bcb d90a1990ac
1 changed files with 7 additions and 1 deletions
--- a/Library/Homebrew/formula_creator.rb
+++ b/Library/Homebrew/formula_creator.rb
@ -82,7 +82,13 @@ module Homebrew
          r = Resource.new
          r.url(@url)
          r.owner = self
-          @sha256 = r.fetch.sha256 if r.download_strategy == CurlDownloadStrategy
+          filepath = r.fetch
+          html_doctype_prefix = "<!doctype html"
+          if File.read(filepath, html_doctype_prefix.length).downcase.start_with?(html_doctype_prefix)
+            raise "Downloaded URL is not archive"
+          end
+
+          @sha256 = filepath.sha256
        end

        if @github