From 793986ae0aa229153471eee6ed89e346a7ca437a Mon Sep 17 00:00:00 2001 From: Quratulain-bilal Date: Fri, 31 Jul 2026 16:50:56 +0500 Subject: [PATCH] fix: use incremental hashing in Preset.get_hash() to avoid loading entire file into memory Preset.get_hash() called f.read() which loads the entire file into memory before hashing. Use incremental hashlib.sha256().update() with 64 KiB chunks to prevent unbounded memory allocation on large or maliciously sized preset files. --- src/specify_cli/presets/__init__.py | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/src/specify_cli/presets/__init__.py b/src/specify_cli/presets/__init__.py index de4116228e..66823bcd9c 100644 --- a/src/specify_cli/presets/__init__.py +++ b/src/specify_cli/presets/__init__.py @@ -452,8 +452,11 @@ def tags(self) -> List[str]: def get_hash(self) -> str: """Calculate SHA256 hash of manifest file.""" + h = hashlib.sha256() with open(self.path, 'rb') as f: - return f"sha256:{hashlib.sha256(f.read()).hexdigest()}" + for chunk in iter(lambda: f.read(65536), b''): + h.update(chunk) + return f"sha256:{h.hexdigest()}" class PresetRegistry: