Skip to content

Commit dace0ce

Browse files
zeripath6543lafriks
authored
Prevent addition of labels from outside the repository or organisation in issues (#14912)
* Never add labels not from this repository or organisation and remove org labels on transfer Prevent the addition of labels from outside of the repository or organisation and remove organisation labels on transfer. Related #14908 Signed-off-by: Andrew Thornton <[email protected]> * switch to use sql Signed-off-by: Andrew Thornton <[email protected]> * remove AS Signed-off-by: Andrew Thornton <[email protected]> * subquery alias Signed-off-by: Andrew Thornton <[email protected]> * Give me some AS? Signed-off-by: Andrew Thornton <[email protected]> * double AS Signed-off-by: Andrew Thornton <[email protected]> * try try again Signed-off-by: Andrew Thornton <[email protected]> * once more around the merry go round Signed-off-by: Andrew Thornton <[email protected]> * fix api problem Signed-off-by: Andrew Thornton <[email protected]> * Add outside label consistency check into doctor This PR adds another consistency check into doctor in order to detect labels that have been added from outside of repositories and organisations Fix #14908 Signed-off-by: Andrew Thornton <[email protected]> * fix migration Signed-off-by: Andrew Thornton <[email protected]> * prep for merge Signed-off-by: Andrew Thornton <[email protected]> Co-authored-by: 6543 <[email protected]> Co-authored-by: Lauris BH <[email protected]>
1 parent 54d7b0f commit dace0ce

File tree

4 files changed

+173
-0
lines changed

4 files changed

+173
-0
lines changed

‎models/consistency.go

Lines changed: 58 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -319,6 +319,64 @@ func FixCommentTypeLabelWithEmptyLabel() (int64, error) {
319319
return x.Where(builder.Eq{"type": CommentTypeLabel, "label_id": 0}).Delete(new(Comment))
320320
}
321321

322+
// CountCommentTypeLabelWithOutsideLabels count label comments with outside label
323+
func CountCommentTypeLabelWithOutsideLabels() (int64, error) {
324+
return x.Where("comment.type = ? AND (issue.repo_id != label.repo_id OR (label.repo_id = 0 AND repository.owner_id != label.org_id))", CommentTypeLabel).
325+
Table("comment").
326+
Join("inner", "label", "label.id = comment.label_id").
327+
Join("inner", "issue", "issue.id = comment.issue_id ").
328+
Join("inner", "repository", "issue.repo_id = repository.id").
329+
Count(new(Comment))
330+
}
331+
332+
// FixCommentTypeLabelWithOutsideLabels count label comments with outside label
333+
func FixCommentTypeLabelWithOutsideLabels() (int64, error) {
334+
res, err := x.Exec(`DELETE FROM comment WHERE comment.id IN (
335+
SELECT il_too.id FROM (
336+
SELECT com.id
337+
FROM comment AS com
338+
INNER JOIN label ON com.label_id = label.id
339+
INNER JOIN issue on issue.id = com.issue_id
340+
WHERE
341+
com.type = ? AND (issue.repo_id != label.repo_id OR (label.repo_id = 0 AND label.org_id != repo.owner_id))
342+
) AS il_too)`, CommentTypeLabel)
343+
if err != nil {
344+
return 0, err
345+
}
346+
347+
return res.RowsAffected()
348+
}
349+
350+
// CountIssueLabelWithOutsideLabels count label comments with outside label
351+
func CountIssueLabelWithOutsideLabels() (int64, error) {
352+
return x.Where(builder.Expr("issue.repo_id != label.repo_id OR (label.repo_id = 0 AND repository.owner_id != label.org_id)")).
353+
Table("issue_label").
354+
Join("inner", "label", "issue_label.id = label.id ").
355+
Join("inner", "issue", "issue.id = issue_label.issue_id ").
356+
Join("inner", "repository", "issue.repo_id = repository.id").
357+
Count(new(IssueLabel))
358+
}
359+
360+
// FixIssueLabelWithOutsideLabels fix label comments with outside label
361+
func FixIssueLabelWithOutsideLabels() (int64, error) {
362+
res, err := x.Exec(`DELETE FROM issue_label WHERE issue_label.id IN (
363+
SELECT il_too.id FROM (
364+
SELECT il_too_too.id
365+
FROM issue_label AS il_too_too
366+
INNER JOIN label ON il_too_too.id = label.id
367+
INNER JOIN issue on issue.id = il_too_too.issue_id
368+
INNER JOIN repository on repository.id = issue.repo_id
369+
WHERE
370+
issue.repo_id != label.repo_id OR (label.repo_id = 0 AND label.org_id != repository.owner_id)
371+
) AS il_too )`)
372+
373+
if err != nil {
374+
return 0, err
375+
}
376+
377+
return res.RowsAffected()
378+
}
379+
322380
// CountBadSequences looks for broken sequences from recreate-table mistakes
323381
func CountBadSequences() (int64, error) {
324382
if !setting.Database.UsePostgreSQL {

‎models/migrations/migrations.go

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -298,6 +298,8 @@ var migrations = []Migration{
298298
NewMigration("create repo transfer table", addRepoTransfer),
299299
// v175 -> v176
300300
NewMigration("Fix Postgres ID Sequences broken by recreate-table", fixPostgresIDSequences),
301+
// v176 -> v177
302+
NewMigration("Remove invalid labels from comments", removeInvalidLabels),
301303
}
302304

303305
// GetCurrentDBVersion returns the current db version

‎models/migrations/v176.go

Lines changed: 74 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,74 @@
1+
// Copyright 2021 The Gitea Authors. All rights reserved.
2+
// Use of this source code is governed by a MIT-style
3+
// license that can be found in the LICENSE file.
4+
5+
package migrations
6+
7+
import (
8+
"xorm.io/xorm"
9+
)
10+
11+
func removeInvalidLabels(x *xorm.Engine) error {
12+
type Comment struct {
13+
ID int64 `xorm:"pk autoincr"`
14+
Type int `xorm:"INDEX"`
15+
IssueID int64 `xorm:"INDEX"`
16+
LabelID int64
17+
}
18+
19+
type Issue struct {
20+
ID int64 `xorm:"pk autoincr"`
21+
RepoID int64 `xorm:"INDEX UNIQUE(repo_index)"`
22+
Index int64 `xorm:"UNIQUE(repo_index)"` // Index in one repository.
23+
}
24+
25+
type Repository struct {
26+
ID int64 `xorm:"pk autoincr"`
27+
OwnerID int64 `xorm:"UNIQUE(s) index"`
28+
LowerName string `xorm:"UNIQUE(s) INDEX NOT NULL"`
29+
}
30+
31+
type Label struct {
32+
ID int64 `xorm:"pk autoincr"`
33+
RepoID int64 `xorm:"INDEX"`
34+
OrgID int64 `xorm:"INDEX"`
35+
}
36+
37+
type IssueLabel struct {
38+
ID int64 `xorm:"pk autoincr"`
39+
IssueID int64 `xorm:"UNIQUE(s)"`
40+
LabelID int64 `xorm:"UNIQUE(s)"`
41+
}
42+
43+
if err := x.Sync2(new(Comment), new(Issue), new(Repository), new(Label), new(IssueLabel)); err != nil {
44+
return err
45+
}
46+
47+
if _, err := x.Exec(`DELETE FROM issue_label WHERE issue_label.id IN (
48+
SELECT il_too.id FROM (
49+
SELECT il_too_too.id
50+
FROM issue_label AS il_too_too
51+
INNER JOIN label ON il_too_too.id = label.id
52+
INNER JOIN issue on issue.id = il_too_too.issue_id
53+
INNER JOIN repository on repository.id = issue.repo_id
54+
WHERE
55+
issue.repo_id != label.repo_id OR (label.repo_id = 0 AND label.org_id != repository.owner_id)
56+
) AS il_too )`); err != nil {
57+
return err
58+
}
59+
60+
if _, err := x.Exec(`DELETE FROM comment WHERE comment.id IN (
61+
SELECT il_too.id FROM (
62+
SELECT com.id
63+
FROM comment AS com
64+
INNER JOIN label ON com.label_id = label.id
65+
INNER JOIN issue on issue.id = com.issue_id
66+
INNER JOIN repository on repository.id = issue.repo_id
67+
WHERE
68+
com.type = ? AND (issue.repo_id != label.repo_id OR (label.repo_id = 0 AND label.org_id != repository.owner_id))
69+
) AS il_too)`, 7); err != nil {
70+
return err
71+
}
72+
73+
return nil
74+
}

‎modules/doctor/dbconsistency.go

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -130,6 +130,45 @@ func checkDBConsistency(logger log.Logger, autofix bool) error {
130130
logger.Warn("%d label comments with empty labels", count)
131131
}
132132
}
133+
134+
// find label comments with labels from outside the repository
135+
count, err = models.CountCommentTypeLabelWithOutsideLabels()
136+
if err != nil {
137+
logger.Critical("Error: %v whilst counting label comments with outside labels", err)
138+
return err
139+
}
140+
if count > 0 {
141+
if autofix {
142+
updatedCount, err := models.FixCommentTypeLabelWithOutsideLabels()
143+
if err != nil {
144+
logger.Critical("Error: %v whilst removing label comments with outside labels", err)
145+
return err
146+
}
147+
log.Info("%d label comments with outside labels removed", updatedCount)
148+
} else {
149+
log.Warn("%d label comments with outside labels", count)
150+
}
151+
}
152+
153+
// find issue_label with labels from outside the repository
154+
count, err = models.CountIssueLabelWithOutsideLabels()
155+
if err != nil {
156+
logger.Critical("Error: %v whilst counting issue_labels from outside the repository or organisation", err)
157+
return err
158+
}
159+
if count > 0 {
160+
if autofix {
161+
updatedCount, err := models.FixIssueLabelWithOutsideLabels()
162+
if err != nil {
163+
logger.Critical("Error: %v whilst removing issue_labels from outside the repository or organisation", err)
164+
return err
165+
}
166+
logger.Info("%d issue_labels from outside the repository or organisation removed", updatedCount)
167+
} else {
168+
logger.Warn("%d issue_labels from outside the repository or organisation", count)
169+
}
170+
}
171+
133172
// TODO: function to recalc all counters
134173

135174
if setting.Database.UsePostgreSQL {

0 commit comments

Comments
 (0)