API /repos​/{owner}​/{repo}​/raw​/{filepath} fails if filepath is 40-char long

[danielemoroni]

Gitea Version

1.12.3

Git Version

No response

Operating System

No response

How are you running Gitea?

I deployed an official download to my server

Database

No response

Can you reproduce the bug on the Gitea demo site?

Yes

Log Gist

No response

Description

The Gitea API GET /repos​/{owner}​/{repo}​/raw​/{filepath} fails with http error 404 (or "object does not exist" in the latest gitea version) if the filepath is 40-character long.

I replicated the issue on https://try.gitea.io/danielemoroni/raw_api:
. This fails:
https://try.gitea.io/api/v1/repos/danielemoroni/raw_api/raw/filename_40char_long_xxxxxxxxxxxxxxx.txt
. This succeeds:
https://try.gitea.io/api/v1/repos/danielemoroni/raw_api/raw/filename_41char_long_xxxxxxxxxxxxxxxx.txt

The files are actually identical. I can retrieve them both without problems with another API, e.g.
https://try.gitea.io/danielemoroni/raw_api/src/branch/master/filename_40char_long_xxxxxxxxxxxxxxx.txt

Screenshots

No response

[lunny]

Could you upgrade to latest stable version?

[noerw]

what an odd bug 👀 maybe Gitea special-cases 40 chars, because git SHAs can have that length?

edit: yup, looks like that's the case:

gitea/modules/context/api.go

Line 416 in 91e21d4

} else if len(refName) == 40 {

@lunny they reproduced with try.gitea.io, I guess that's good enough

[noerw]

@danielemoroni this is a stupid bug, you can work around this by prefixing your filepath with $repo_default_branch/.

However, this way to specify a ref will possibly be deprecated in 1.16, and the way you currently use this will be fixed in 1.16.0 and 1.15.4. As your Gitea version 1.12 does not receive fixes anyway, you're probably best off to update Gitea to >=1.15.4 once released, instead of adapting your API client.

[danielemoroni]

@noerw Thank you for the explanation, and the quick response.

We tend to upgrade our gitea once a year, so we'll pick this up in our next round. I'll bear in mind the deprecation, it's not too bad to change the API calls on our side, so we might do both at the same time.