Skip to content

Commit d74211e

Browse files
HesterGHesterG
authored
Merge branch 'main' into lock-pin-fetch
2 parents 2885e76 + df5cf5d commit d74211e

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

55 files changed

+1045
-312
lines changed

‎.devcontainer/devcontainer.json

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,8 @@
55
// installs nodejs into container
66
"ghcr.io/devcontainers/features/node:1": {
77
"version":"20"
8-
}
8+
},
9+
"ghcr.io/devcontainers/features/git-lfs:1.1.0": {}
910
},
1011
"customizations": {
1112
"vscode": {
@@ -20,7 +21,7 @@
2021
"Vue.volar",
2122
"ms-azuretools.vscode-docker",
2223
"zixuanchen.vitest-explorer",
23-
"alexcvzz.vscode-sqlite"
24+
"qwtel.sqlite-viewer"
2425
]
2526
}
2627
},

‎.gitpod.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -34,7 +34,7 @@ vscode:
3434
- Vue.volar
3535
- ms-azuretools.vscode-docker
3636
- zixuanchen.vitest-explorer
37-
- alexcvzz.vscode-sqlite
37+
- qwtel.sqlite-viewer
3838

3939
ports:
4040
- name: Gitea

‎cmd/web.go

Lines changed: 9 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -217,9 +217,15 @@ func setPort(port string) error {
217217
defaultLocalURL += ":" + setting.HTTPPort + "/"
218218

219219
// Save LOCAL_ROOT_URL if port changed
220-
setting.CfgProvider.Section("server").Key("LOCAL_ROOT_URL").SetValue(defaultLocalURL)
221-
if err := setting.CfgProvider.Save(); err != nil {
222-
return fmt.Errorf("Failed to save config file: %v", err)
220+
rootCfg := setting.CfgProvider
221+
saveCfg, err := rootCfg.PrepareSaving()
222+
if err != nil {
223+
return fmt.Errorf("failed to save config file: %v", err)
224+
}
225+
rootCfg.Section("server").Key("LOCAL_ROOT_URL").SetValue(defaultLocalURL)
226+
saveCfg.Section("server").Key("LOCAL_ROOT_URL").SetValue(defaultLocalURL)
227+
if err = saveCfg.Save(); err != nil {
228+
return fmt.Errorf("failed to save config file: %v", err)
223229
}
224230
}
225231
return nil

‎docs/content/doc/usage/template-repositories.en-us.md

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -51,6 +51,8 @@ a/b/c/d.json
5151

5252
In any file matched by the above globs, certain variables will be expanded.
5353

54+
Matching filenames and paths can also be expanded, and are conservatively sanitized to support cross-platform filesystems.
55+
5456
All variables must be of the form `$VAR` or `${VAR}`. To escape an expansion, use a double `$$`, such as `$$VAR` or `$${VAR}`
5557

5658
| Variable | Expands To | Transformable |

‎models/actions/variable.go

Lines changed: 97 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,97 @@
1+
// Copyright 2023 The Gitea Authors. All rights reserved.
2+
// SPDX-License-Identifier: MIT
3+
4+
package actions
5+
6+
import (
7+
"context"
8+
"errors"
9+
"fmt"
10+
"strings"
11+
12+
"code.gitea.io/gitea/models/db"
13+
"code.gitea.io/gitea/modules/timeutil"
14+
"code.gitea.io/gitea/modules/util"
15+
16+
"xorm.io/builder"
17+
)
18+
19+
type ActionVariable struct {
20+
ID int64 `xorm:"pk autoincr"`
21+
OwnerID int64 `xorm:"UNIQUE(owner_repo_name)"`
22+
RepoID int64 `xorm:"INDEX UNIQUE(owner_repo_name)"`
23+
Name string `xorm:"UNIQUE(owner_repo_name) NOT NULL"`
24+
Data string `xorm:"LONGTEXT NOT NULL"`
25+
CreatedUnix timeutil.TimeStamp `xorm:"created NOT NULL"`
26+
UpdatedUnix timeutil.TimeStamp `xorm:"updated"`
27+
}
28+
29+
func init() {
30+
db.RegisterModel(new(ActionVariable))
31+
}
32+
33+
func (v *ActionVariable) Validate() error {
34+
if v.OwnerID == 0 && v.RepoID == 0 {
35+
return errors.New("the variable is not bound to any scope")
36+
}
37+
return nil
38+
}
39+
40+
func InsertVariable(ctx context.Context, ownerID, repoID int64, name, data string) (*ActionVariable, error) {
41+
variable := &ActionVariable{
42+
OwnerID: ownerID,
43+
RepoID: repoID,
44+
Name: strings.ToUpper(name),
45+
Data: data,
46+
}
47+
if err := variable.Validate(); err != nil {
48+
return variable, err
49+
}
50+
return variable, db.Insert(ctx, variable)
51+
}
52+
53+
type FindVariablesOpts struct {
54+
db.ListOptions
55+
OwnerID int64
56+
RepoID int64
57+
}
58+
59+
func (opts *FindVariablesOpts) toConds() builder.Cond {
60+
cond := builder.NewCond()
61+
if opts.OwnerID > 0 {
62+
cond = cond.And(builder.Eq{"owner_id": opts.OwnerID})
63+
}
64+
if opts.RepoID > 0 {
65+
cond = cond.And(builder.Eq{"repo_id": opts.RepoID})
66+
}
67+
return cond
68+
}
69+
70+
func FindVariables(ctx context.Context, opts FindVariablesOpts) ([]*ActionVariable, error) {
71+
var variables []*ActionVariable
72+
sess := db.GetEngine(ctx)
73+
if opts.PageSize != 0 {
74+
sess = db.SetSessionPagination(sess, &opts.ListOptions)
75+
}
76+
return variables, sess.Where(opts.toConds()).Find(&variables)
77+
}
78+
79+
func GetVariableByID(ctx context.Context, variableID int64) (*ActionVariable, error) {
80+
var variable ActionVariable
81+
has, err := db.GetEngine(ctx).Where("id=?", variableID).Get(&variable)
82+
if err != nil {
83+
return nil, err
84+
} else if !has {
85+
return nil, fmt.Errorf("variable with id %d: %w", variableID, util.ErrNotExist)
86+
}
87+
return &variable, nil
88+
}
89+
90+
func UpdateVariable(ctx context.Context, variable *ActionVariable) (bool, error) {
91+
count, err := db.GetEngine(ctx).ID(variable.ID).Cols("name", "data").
92+
Update(&ActionVariable{
93+
Name: variable.Name,
94+
Data: variable.Data,
95+
})
96+
return count != 0, err
97+
}

‎models/migrations/migrations.go

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -503,6 +503,9 @@ var migrations = []Migration{
503503

504504
// v260 -> v261
505505
NewMigration("Drop custom_labels column of action_runner table", v1_21.DropCustomLabelsColumnOfActionRunner),
506+
507+
// v261 -> v262
508+
NewMigration("Add variable table", v1_21.CreateVariableTable),
506509
}
507510

508511
// GetCurrentDBVersion returns the current db version

‎models/migrations/v1_21/v261.go

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
// Copyright 2023 The Gitea Authors. All rights reserved.
2+
// SPDX-License-Identifier: MIT
3+
4+
package v1_21 //nolint
5+
6+
import (
7+
"code.gitea.io/gitea/modules/timeutil"
8+
9+
"xorm.io/xorm"
10+
)
11+
12+
func CreateVariableTable(x *xorm.Engine) error {
13+
type ActionVariable struct {
14+
ID int64 `xorm:"pk autoincr"`
15+
OwnerID int64 `xorm:"UNIQUE(owner_repo_name)"`
16+
RepoID int64 `xorm:"INDEX UNIQUE(owner_repo_name)"`
17+
Name string `xorm:"UNIQUE(owner_repo_name) NOT NULL"`
18+
Data string `xorm:"LONGTEXT NOT NULL"`
19+
CreatedUnix timeutil.TimeStamp `xorm:"created NOT NULL"`
20+
UpdatedUnix timeutil.TimeStamp `xorm:"updated"`
21+
}
22+
23+
return x.Sync(new(ActionVariable))
24+
}

‎models/secret/secret.go

Lines changed: 4 additions & 38 deletions
Original file line numberDiff line numberDiff line change
@@ -5,38 +5,17 @@ package secret
55

66
import (
77
"context"
8-
"fmt"
9-
"regexp"
8+
"errors"
109
"strings"
1110

1211
"code.gitea.io/gitea/models/db"
1312
secret_module "code.gitea.io/gitea/modules/secret"
1413
"code.gitea.io/gitea/modules/setting"
1514
"code.gitea.io/gitea/modules/timeutil"
16-
"code.gitea.io/gitea/modules/util"
1715

1816
"xorm.io/builder"
1917
)
2018

21-
type ErrSecretInvalidValue struct {
22-
Name *string
23-
Data *string
24-
}
25-
26-
func (err ErrSecretInvalidValue) Error() string {
27-
if err.Name != nil {
28-
return fmt.Sprintf("secret name %q is invalid", *err.Name)
29-
}
30-
if err.Data != nil {
31-
return fmt.Sprintf("secret data %q is invalid", *err.Data)
32-
}
33-
return util.ErrInvalidArgument.Error()
34-
}
35-
36-
func (err ErrSecretInvalidValue) Unwrap() error {
37-
return util.ErrInvalidArgument
38-
}
39-
4019
// Secret represents a secret
4120
type Secret struct {
4221
ID int64
@@ -74,24 +53,11 @@ func init() {
7453
db.RegisterModel(new(Secret))
7554
}
7655

77-
var (
78-
secretNameReg = regexp.MustCompile("^[A-Z_][A-Z0-9_]*$")
79-
forbiddenSecretPrefixReg = regexp.MustCompile("^GIT(EA|HUB)_")
80-
)
81-
82-
// Validate validates the required fields and formats.
8356
func (s *Secret) Validate() error {
84-
switch {
85-
case len(s.Name) == 0 || len(s.Name) > 50:
86-
return ErrSecretInvalidValue{Name: &s.Name}
87-
case len(s.Data) == 0:
88-
return ErrSecretInvalidValue{Data: &s.Data}
89-
case !secretNameReg.MatchString(s.Name) ||
90-
forbiddenSecretPrefixReg.MatchString(s.Name):
91-
return ErrSecretInvalidValue{Name: &s.Name}
92-
default:
93-
return nil
57+
if s.OwnerID == 0 && s.RepoID == 0 {
58+
return errors.New("the secret is not bound to any scope")
9459
}
60+
return nil
9561
}
9662

9763
type FindSecretsOptions struct {

‎modules/repository/generate.go

Lines changed: 30 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,7 @@ import (
1111
"os"
1212
"path"
1313
"path/filepath"
14+
"regexp"
1415
"strings"
1516
"time"
1617

@@ -48,7 +49,7 @@ var defaultTransformers = []transformer{
4849
{Name: "TITLE", Transform: util.ToTitleCase},
4950
}
5051

51-
func generateExpansion(src string, templateRepo, generateRepo *repo_model.Repository) string {
52+
func generateExpansion(src string, templateRepo, generateRepo *repo_model.Repository, sanitizeFileName bool) string {
5253
expansions := []expansion{
5354
{Name: "REPO_NAME", Value: generateRepo.Name, Transformers: defaultTransformers},
5455
{Name: "TEMPLATE_NAME", Value: templateRepo.Name, Transformers: defaultTransformers},
@@ -74,6 +75,9 @@ func generateExpansion(src string, templateRepo, generateRepo *repo_model.Reposi
7475

7576
return os.Expand(src, func(key string) string {
7677
if expansion, ok := expansionMap[key]; ok {
78+
if sanitizeFileName {
79+
return fileNameSanitize(expansion)
80+
}
7781
return expansion
7882
}
7983
return key
@@ -191,10 +195,24 @@ func generateRepoCommit(ctx context.Context, repo, templateRepo, generateRepo *r
191195
}
192196

193197
if err := os.WriteFile(path,
194-
[]byte(generateExpansion(string(content), templateRepo, generateRepo)),
198+
[]byte(generateExpansion(string(content), templateRepo, generateRepo, false)),
195199
0o644); err != nil {
196200
return err
197201
}
202+
203+
substPath := filepath.FromSlash(filepath.Join(tmpDirSlash,
204+
generateExpansion(base, templateRepo, generateRepo, true)))
205+
206+
// Create parent subdirectories if needed or continue silently if it exists
207+
if err := os.MkdirAll(filepath.Dir(substPath), 0o755); err != nil {
208+
return err
209+
}
210+
211+
// Substitute filename variables
212+
if err := os.Rename(path, substPath); err != nil {
213+
return err
214+
}
215+
198216
break
199217
}
200218
}
@@ -353,3 +371,13 @@ func GenerateRepository(ctx context.Context, doer, owner *user_model.User, templ
353371

354372
return generateRepo, nil
355373
}
374+
375+
// Sanitize user input to valid OS filenames
376+
//
377+
// Based on https://github.com/sindresorhus/filename-reserved-regex
378+
// Adds ".." to prevent directory traversal
379+
func fileNameSanitize(s string) string {
380+
re := regexp.MustCompile(`(?i)\.\.|[<>:\"/\\|?*\x{0000}-\x{001F}]|^(con|prn|aux|nul|com\d|lpt\d)$`)
381+
382+
return strings.TrimSpace(re.ReplaceAllString(s, "_"))
383+
}

‎modules/repository/generate_test.go

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -54,3 +54,14 @@ func TestGiteaTemplate(t *testing.T) {
5454
})
5555
}
5656
}
57+
58+
func TestFileNameSanitize(t *testing.T) {
59+
assert.Equal(t, "test_CON", fileNameSanitize("test_CON"))
60+
assert.Equal(t, "test CON", fileNameSanitize("test CON "))
61+
assert.Equal(t, "__traverse__", fileNameSanitize("../traverse/.."))
62+
assert.Equal(t, "http___localhost_3003_user_test.git", fileNameSanitize("http://localhost:3003/user/test.git"))
63+
assert.Equal(t, "_", fileNameSanitize("CON"))
64+
assert.Equal(t, "_", fileNameSanitize("con"))
65+
assert.Equal(t, "_", fileNameSanitize("\u0000"))
66+
assert.Equal(t, "目标", fileNameSanitize("目标"))
67+
}

0 commit comments

Comments
 (0)