fix(pulls): tolerate invalid stored review commit_id (#39849)

Fixes #39848

---------

Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>

modules/git/blame.go

@@ -7,19 +7,28 @@ import (
 	"bufio"
 	"bytes"
 	"context"
+	"fmt"
 	"io"
+	"strings"
 
 	"gitea.dev/modules/git/gitcmd"
 	"gitea.dev/modules/setting"
 )
 
-func LineBlame(ctx context.Context, repo RepositoryFacade, revision, file string, line uint) (string, error) {
+func LineBlameCommitID(ctx context.Context, repo RepositoryFacade, revision, file string, line uint) (string, error) {
 	stdout, _, err := gitcmd.NewCommand("blame").WithRepo(repo).
 		AddOptionFormat("-L %d,%d", line, line).
 		AddOptionValues("-p", revision).
 		AddDashesAndList(file).
 		RunStdString(ctx)
-	return stdout, err
+	if err != nil {
+		return "", err
+	}
+	commitID, _, _ := strings.Cut(stdout, " ")
+	if !IsStringValidObjectID(nil, commitID) {
+		return "", fmt.Errorf("LineBlameCommitID: invalid commit ID %q", commitID)
+	}
+	return commitID, nil
 }
 
 // BlamePart represents block of blame - continuous lines with one sha

modules/git/blame_test.go

@@ -11,6 +11,18 @@ import (
 	"github.com/stretchr/testify/assert"
 )
 
+func TestLineBlameCommitID(t *testing.T) {
+	storage := mockRepository("repo5_pulls")
+	const revision = "f32b0a9dfd09a60f616f29158f772cedd89942d2"
+	commitID, err := LineBlameCommitID(t.Context(), storage, revision, "README.md", 1)
+	assert.NoError(t, err)
+	assert.Equal(t, "72866af952e98d02a73003501836074b286a78f6", commitID)
+
+	commitID, err = LineBlameCommitID(t.Context(), storage, revision, "missing.txt", 1)
+	assert.Error(t, err)
+	assert.Empty(t, commitID)
+}
+
 func TestReadingBlameOutput(t *testing.T) {
 	setting.AppDataPath = t.TempDir()
 	ctx := t.Context()

modules/git/gitcmd/error.go

@@ -93,6 +93,7 @@ const (
 	StderrPathSpec           StderrPrefix = "fatal: pathspec"
 	StderrBadRevision        StderrPrefix = "fatal: bad revision"
 	StderrNoSuchPath         StderrPrefix = "fatal: no such path"
+	StderrBadObject          StderrPrefix = "fatal: bad object "
 
 	StderrNoSuchRemote StderrPrefix = "error: no such remote"