fix: git cache (#38763)

1. always use "last commit cache"
2. correctly build the cache key for any input (SafeCacheKey)
3. fix the git note "last commit cache FIXME" and avoid OOM

modules/cache/cache.go

@@ -4,6 +4,7 @@
 package cache
 
 import (
+	"crypto/sha256"
 	"encoding/hex"
 	"errors"
 	"fmt"
@@ -11,6 +12,7 @@ import (
 	"time"
 
 	"gitea.dev/modules/setting"
+	"gitea.dev/modules/util"
 
 	_ "gitea.com/go-chi/cache/memcache" //nolint:depguard // memcache plugin for cache, it is required for config "ADAPTER=memcache"
 )
@@ -117,3 +119,30 @@ func Remove(key string) {
 	}
 	_ = defaultCache.Delete(key)
 }
+
+// SafeCacheKey returns a cache-safe key for the input string
+// Some caches like memcached have char & length limits.
+// Caller must make sure the prefix is valid and well-designed.
+// If prefix is already too long, the returned key will still exceed the limit, then just let the cache report an error.
+func SafeCacheKey(prefix, input string) string {
+	// memcached has a limit 250 for key length, so we use 230 to leave some room for other prefixes and separators
+	return safeCacheKey(prefix, input, 230)
+}
+
+func safeCacheKey(prefix, input string, limit int) string {
+	safeAsKey := len(prefix)+len(input)+3 <= limit
+	if safeAsKey {
+		for i := 0; i < len(input); i++ {
+			if c := input[i]; c <= ' ' || c >= 127 {
+				safeAsKey = false
+				break
+			}
+		}
+	}
+	sep, key := ":s-", input
+	if !safeAsKey {
+		hashBytes := sha256.Sum256(util.UnsafeStringToBytes(input))
+		sep, key = ":h-", hex.EncodeToString(hashBytes[:])
+	}
+	return prefix + sep + key
+}

modules/cache/cache_test.go

@@ -124,3 +124,11 @@ func TestGetInt64(t *testing.T) {
 	assert.EqualValues(t, 100, data)
 	Remove("key")
 }
+
+func TestSafeCacheKey(t *testing.T) {
+	assert.Equal(t, "prefix:s-0~", safeCacheKey("prefix", "0~", 100))
+	assert.Equal(t, "prefix:h-36a9e7f1c95b82ffb99743e0c5c4ce95d83c9a430aac59f84ef3cbfab6145068", safeCacheKey("prefix", " ", 100))
+
+	assert.Equal(t, "prefix:s-a", safeCacheKey("prefix", "a", 10))
+	assert.Equal(t, "prefix:h-961b6dd3ede3cb8ecbaacbd68de040cd78eb2ed5889130cceb4c49268ea4d506", safeCacheKey("prefix", "aa", 10))
+}