USEFULL
/
gogs
mirror of https://github.com/gogs/gogs.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

repo_editor: check both styles of `os.PathSeparator` in all systems (#7005)

pull/7006/head
Joe Chen 2022-06-04 13:11:29 +08:00 committed by GitHub
parent 69827490e0
commit 38aff73251
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
3 changed files with 32 additions and 16 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
CHANGELOG.md
View File

@ -22,6 +22,7 @@ All notable changes to Gogs are documented in this file.
### Fixed
- _Security:_ OS Command Injection in file editor. [#7000](https://github.com/gogs/gogs/issues/7000)
- Unable to use LDAP authentication on ARM machines. [#6761](https://github.com/gogs/gogs/issues/6761)
- Unable to init repository during creation on Windows. [#6967](https://github.com/gogs/gogs/issues/6967)
- Mysterious panic on `Value not found for type *repo.HTTPContext`. [#6963](https://github.com/gogs/gogs/issues/6963)

6
internal/db/repo_editor.go
View File

@ -467,10 +467,12 @@ type UploadRepoFileOptions struct {
// path of the repository.
func isRepositoryGitPath(path string) bool {
return strings.HasSuffix(path, ".git") ||
strings.Contains(path, ".git"+string(os.PathSeparator)) ||
strings.Contains(path, ".git/") ||
strings.Contains(path, `.git\`) ||
// Windows treats ".git." the same as ".git"
strings.HasSuffix(path, ".git.") ||
strings.Contains(path, ".git."+string(os.PathSeparator))
strings.Contains(path, ".git./") ||
strings.Contains(path, `.git.\`)
}
func (repo *Repository) UploadRepoFiles(doer *User, opts UploadRepoFileOptions) error {

41
internal/db/repo_editor_test.go
View File

@ -5,7 +5,6 @@
package db
import (
"path/filepath"
"testing"
"github.com/stretchr/testify/assert"
@ -16,23 +15,37 @@ func Test_isRepositoryGitPath(t *testing.T) {
path string
wantVal bool
}{
{path: filepath.Join(".", ".git"), wantVal: true},
{path: filepath.Join(".", ".git", ""), wantVal: true},
{path: filepath.Join(".", ".git", "hooks", "pre-commit"), wantVal: true},
{path: filepath.Join(".git", "hooks"), wantVal: true},
{path: filepath.Join("dir", ".git"), wantVal: true},
{path: ".git", wantVal: true},
{path: "./.git", wantVal: true},
{path: ".git/hooks/pre-commit", wantVal: true},
{path: ".git/hooks", wantVal: true},
{path: "dir/.git", wantVal: true},
{path: filepath.Join(".", ".git."), wantVal: true},
{path: filepath.Join(".", ".git.", ""), wantVal: true},
{path: filepath.Join(".", ".git.", "hooks", "pre-commit"), wantVal: true},
{path: filepath.Join(".git.", "hooks"), wantVal: true},
{path: filepath.Join("dir", ".git."), wantVal: true},
{path: ".gitignore", wantVal: false},
{path: "dir/.gitkeep", wantVal: false},
{path: filepath.Join(".gitignore"), wantVal: false},
{path: filepath.Join("dir", ".gitkeep"), wantVal: false},
// Windows-specific
{path: `.git\`, wantVal: true},
{path: `.git\hooks\pre-commit`, wantVal: true},
{path: `.git\hooks`, wantVal: true},
{path: `dir\.git`, wantVal: true},
{path: `.\.git.`, wantVal: true},
{path: `.\.git.\`, wantVal: true},
{path: `.git.\hooks\pre-commit`, wantVal: true},
{path: `.git.\hooks`, wantVal: true},
{path: `dir\.git.`, wantVal: true},
{path: "./.git.", wantVal: true},
{path: "./.git./", wantVal: true},
{path: ".git./hooks/pre-commit", wantVal: true},
{path: ".git./hooks", wantVal: true},
{path: "dir/.git.", wantVal: true},
{path: `dir\.gitkeep`, wantVal: false},
}
for _, test := range tests {
t.Run("", func(t *testing.T) {
t.Run(test.path, func(t *testing.T) {
assert.Equal(t, test.wantVal, isRepositoryGitPath(test.path))
})
}