add more test

Author: lunny

modules/storage/local.go

@@ -7,10 +7,12 @@ package storage
 import (
 	"context"
 	"errors"
+	"fmt"
 	"io"
 	"net/url"
 	"os"
 	"path/filepath"
+	"strings"
 
 	"code.gitea.io/gitea/modules/log"
 	"code.gitea.io/gitea/modules/util"
@@ -62,15 +64,15 @@ func NewLocalStorage(ctx context.Context, cfg interface{}) (ObjectStorage, error
 
 // Open a file
 func (l *LocalStorage) Open(path string) (Object, error) {
-	if !l.isValid(path) {
+	if !isLocalPathValid(path) {
 		return nil, ErrLocalPathNotSupported
 	}
 	return os.Open(filepath.Join(l.dir, path))
 }
 
 // Save a file
 func (l *LocalStorage) Save(path string, r io.Reader, size int64) (int64, error) {
-	if !l.isValid(path) {
+	if !isLocalPathValid(path) {
 		return 0, ErrLocalPathNotSupported
 	}
 
@@ -117,17 +119,17 @@ func (l *LocalStorage) Stat(path string) (os.FileInfo, error) {
 	return os.Stat(filepath.Join(l.dir, path))
 }
 
-func (l *LocalStorage) isValid(path string) bool {
-	a, err := filepath.Abs(path)
-	if err != nil {
+func isLocalPathValid(path string) bool {
+	a := filepath.Clean(path)
+	if strings.HasPrefix(a, fmt.Sprintf("..%c", filepath.Separator)) {
 		return false
 	}
-	return a == "/"+path
+	return a == path
 }
 
 // Delete delete a file
 func (l *LocalStorage) Delete(path string) error {
-	if !l.isValid(path) {
+	if !isLocalPathValid(path) {
 		return ErrLocalPathNotSupported
 	}
 	p := filepath.Join(l.dir, path)

modules/storage/local_test.go

@@ -0,0 +1,37 @@
+// Copyright 2022 The Gitea Authors. All rights reserved.
+// Use of this source code is governed by a MIT-style
+// license that can be found in the LICENSE file.
+
+package storage
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestLocalPathIsValid(t *testing.T) {
+	var kases = []struct{
+		path string
+		valid bool
+	} {
+		{
+			"a/0/a0eebc99-9c0b-4ef8-bb6d-6bb9bd380a14",
+			true,
+		},
+		{
+			"../a/0/a0eebc99-9c0b-4ef8-bb6d-6bb9bd380a14",
+			false,
+		},
+		{
+			"b/../a/0/a0eebc99-9c0b-4ef8-bb6d-6bb9bd380a14",
+			false,
+		},
+	}
+
+	for _, k := range kases {
+		t.Run(k.path, func(t *testing.T) {
+			assert.EqualValues(t, k.valid, isLocalPathValid(k.path))
+		})
+	}
+}