mirror of
https://github.com/go-gitea/gitea.git
synced 2026-06-17 19:10:22 +03:00
bircni
9e84deb969
- Enforce repository token scope on RSS/Atom feed endpoints so a PAT without repo scope can no longer read private repo commit data. - Block HTTP redirects during repository migration clones to prevent SSRF reaching internal addresses via an attacker-controlled redirect. - Redact the notification subject after repo access is revoked so private issue/PR metadata is no longer leaked through the notification API. --------- Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
45 lines
1.3 KiB
Go
45 lines
1.3 KiB
Go
// Copyright 2017 The Gitea Authors. All rights reserved.
|
|
// SPDX-License-Identifier: MIT
|
|
|
|
package git
|
|
|
|
import (
|
|
"net/http"
|
|
"net/http/httptest"
|
|
"path/filepath"
|
|
"sync/atomic"
|
|
"testing"
|
|
|
|
"github.com/stretchr/testify/assert"
|
|
)
|
|
|
|
func TestRepoIsEmpty(t *testing.T) {
|
|
emptyRepo2Path := filepath.Join(testReposDir, "repo2_empty")
|
|
repo, err := OpenRepository(t.Context(), emptyRepo2Path)
|
|
assert.NoError(t, err)
|
|
defer repo.Close()
|
|
isEmpty, err := repo.IsEmpty()
|
|
assert.NoError(t, err)
|
|
assert.True(t, isEmpty)
|
|
}
|
|
|
|
// TestCloneRefusesRedirects ensures Clone never follows HTTP redirects, so a remote
|
|
// cannot redirect to an otherwise-blocked address (SSRF, e.g. during migration).
|
|
func TestCloneRefusesRedirects(t *testing.T) {
|
|
var targetHit atomic.Bool
|
|
target := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
|
targetHit.Store(true)
|
|
w.WriteHeader(http.StatusNotFound)
|
|
}))
|
|
defer target.Close()
|
|
|
|
redirect := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
|
http.Redirect(w, r, target.URL+r.URL.Path, http.StatusFound)
|
|
}))
|
|
defer redirect.Close()
|
|
|
|
err := Clone(t.Context(), redirect.URL, filepath.Join(t.TempDir(), "dst"), CloneRepoOptions{})
|
|
assert.Error(t, err)
|
|
assert.False(t, targetHit.Load(), "git must not follow the redirect to the target")
|
|
}
|