0
0
Fork 0
mirror of https://github.com/go-gitea/gitea synced 2024-12-25 21:04:40 +01:00
gitea/integrations
zeripath bbffcc3aec
Multiple Escaping Improvements (#17551)
There are multiple places where Gitea does not properly escape URLs that it is building and there are multiple places where it builds urls when there is already a simpler function available to use this.
    
This is an extensive PR attempting to fix these issues.

1. The first commit in this PR looks through all href, src and links in the Gitea codebase and has attempted to catch all the places where there is potentially incomplete escaping.
2. Whilst doing this we will prefer to use functions that create URLs over recreating them by hand.
3. All uses of strings should be directly escaped - even if they are not currently expected to contain escaping characters. The main benefit to doing this will be that we can consider relaxing the constraints on user names and reponames in future. 
4. The next commit looks at escaping in the wiki and re-considers the urls that are used there. Using the improved escaping here wiki files containing '/'. (This implementation will currently still place all of the wiki files the root directory of the repo but this would not be difficult to change.)
5. The title generation in feeds is now properly escaped.
6. EscapePound is no longer needed - urls should be PathEscaped / QueryEscaped as necessary but then re-escaped with Escape when creating html with locales Signed-off-by: Andrew Thornton <art27@cantab.net>

Signed-off-by: Andrew Thornton <art27@cantab.net>
2021-11-16 18:18:25 +00:00
..
gitea-repositories-meta
migration-test Rename db Engines related functions (#17481) 2021-10-30 22:32:11 +08:00
admin_user_test.go Decouple unit test, remove intermediate unittestbridge package (#17662) 2021-11-16 16:53:21 +08:00
api_admin_org_test.go Decouple unit test, remove intermediate unittestbridge package (#17662) 2021-11-16 16:53:21 +08:00
api_admin_test.go Decouple unit test, remove intermediate unittestbridge package (#17662) 2021-11-16 16:53:21 +08:00
api_branch_test.go
api_comment_test.go Decouple unit test, remove intermediate unittestbridge package (#17662) 2021-11-16 16:53:21 +08:00
api_fork_test.go
api_gpg_keys_test.go
api_helper_for_declarative_test.go refactor: move from io/ioutil to io and os package (#17109) 2021-09-22 13:38:34 +08:00
api_issue_label_test.go Decouple unit test, remove intermediate unittestbridge package (#17662) 2021-11-16 16:53:21 +08:00
api_issue_milestone_test.go Decouple unit test, remove intermediate unittestbridge package (#17662) 2021-11-16 16:53:21 +08:00
api_issue_reaction_test.go Decouple unit test, remove intermediate unittestbridge package (#17662) 2021-11-16 16:53:21 +08:00
api_issue_stopwatch_test.go Decouple unit test, remove intermediate unittestbridge package (#17662) 2021-11-16 16:53:21 +08:00
api_issue_subscription_test.go Decouple unit test, remove intermediate unittestbridge package (#17662) 2021-11-16 16:53:21 +08:00
api_issue_test.go Decouple unit test, remove intermediate unittestbridge package (#17662) 2021-11-16 16:53:21 +08:00
api_issue_tracked_time_test.go Decouple unit test, remove intermediate unittestbridge package (#17662) 2021-11-16 16:53:21 +08:00
api_keys_test.go Decouple unit test, remove intermediate unittestbridge package (#17662) 2021-11-16 16:53:21 +08:00
api_nodeinfo_test.go api: integration test for nodeinfo (#17346) 2021-10-18 01:36:56 -04:00
api_notification_test.go Decouple unit test, remove intermediate unittestbridge package (#17662) 2021-11-16 16:53:21 +08:00
api_oauth2_apps_test.go Decouple unit test, remove intermediate unittestbridge package (#17662) 2021-11-16 16:53:21 +08:00
api_org_test.go Decouple unit test, remove intermediate unittestbridge package (#17662) 2021-11-16 16:53:21 +08:00
api_private_serv_test.go Add integration tests for private.NoServCommand and private.ServCommand (#17456) 2021-10-28 08:32:59 +08:00
api_pull_commits_test.go Decouple unit test, remove intermediate unittestbridge package (#17662) 2021-11-16 16:53:21 +08:00
api_pull_review_test.go Decouple unit test, remove intermediate unittestbridge package (#17662) 2021-11-16 16:53:21 +08:00
api_pull_test.go Decouple unit test, remove intermediate unittestbridge package (#17662) 2021-11-16 16:53:21 +08:00
api_releases_test.go Decouple unit test, remove intermediate unittestbridge package (#17662) 2021-11-16 16:53:21 +08:00
api_repo_edit_test.go Decouple unit test, remove intermediate unittestbridge package (#17662) 2021-11-16 16:53:21 +08:00
api_repo_file_create_test.go Decouple unit test, remove intermediate unittestbridge package (#17662) 2021-11-16 16:53:21 +08:00
api_repo_file_delete_test.go Decouple unit test, remove intermediate unittestbridge package (#17662) 2021-11-16 16:53:21 +08:00
api_repo_file_helpers.go
api_repo_file_update_test.go Decouple unit test, remove intermediate unittestbridge package (#17662) 2021-11-16 16:53:21 +08:00
api_repo_get_contents_list_test.go Decouple unit test, remove intermediate unittestbridge package (#17662) 2021-11-16 16:53:21 +08:00
api_repo_get_contents_test.go Decouple unit test, remove intermediate unittestbridge package (#17662) 2021-11-16 16:53:21 +08:00
api_repo_git_blobs_test.go Decouple unit test, remove intermediate unittestbridge package (#17662) 2021-11-16 16:53:21 +08:00
api_repo_git_commits_test.go Decouple unit test, remove intermediate unittestbridge package (#17662) 2021-11-16 16:53:21 +08:00
api_repo_git_hook_test.go Decouple unit test, remove intermediate unittestbridge package (#17662) 2021-11-16 16:53:21 +08:00
api_repo_git_notes_test.go Decouple unit test, remove intermediate unittestbridge package (#17662) 2021-11-16 16:53:21 +08:00
api_repo_git_ref_test.go Decouple unit test, remove intermediate unittestbridge package (#17662) 2021-11-16 16:53:21 +08:00
api_repo_git_tags_test.go Decouple unit test, remove intermediate unittestbridge package (#17662) 2021-11-16 16:53:21 +08:00
api_repo_git_trees_test.go Decouple unit test, remove intermediate unittestbridge package (#17662) 2021-11-16 16:53:21 +08:00
api_repo_languages_test.go
api_repo_lfs_locks_test.go Decouple unit test, remove intermediate unittestbridge package (#17662) 2021-11-16 16:53:21 +08:00
api_repo_lfs_migrate_test.go Decouple unit test, remove intermediate unittestbridge package (#17662) 2021-11-16 16:53:21 +08:00
api_repo_lfs_test.go Decouple unit test, remove intermediate unittestbridge package (#17662) 2021-11-16 16:53:21 +08:00
api_repo_raw_test.go Decouple unit test, remove intermediate unittestbridge package (#17662) 2021-11-16 16:53:21 +08:00
api_repo_tags_test.go Decouple unit test, remove intermediate unittestbridge package (#17662) 2021-11-16 16:53:21 +08:00
api_repo_teams_test.go Decouple unit test, remove intermediate unittestbridge package (#17662) 2021-11-16 16:53:21 +08:00
api_repo_test.go Decouple unit test, remove intermediate unittestbridge package (#17662) 2021-11-16 16:53:21 +08:00
api_repo_topic_test.go Decouple unit test, remove intermediate unittestbridge package (#17662) 2021-11-16 16:53:21 +08:00
api_settings_test.go
api_team_test.go Decouple unit test, remove intermediate unittestbridge package (#17662) 2021-11-16 16:53:21 +08:00
api_team_user_test.go Decouple unit test, remove intermediate unittestbridge package (#17662) 2021-11-16 16:53:21 +08:00
api_token_test.go Decouple unit test, remove intermediate unittestbridge package (#17662) 2021-11-16 16:53:21 +08:00
api_user_email_test.go
api_user_heatmap_test.go Fix heatmap test (#17381) 2021-10-21 14:37:40 +08:00
api_user_org_perm_test.go [API] Add endpount to get user org permissions (#17232) 2021-10-12 12:47:19 +02:00
api_user_orgs_test.go Decouple unit test, remove intermediate unittestbridge package (#17662) 2021-11-16 16:53:21 +08:00
api_user_search_test.go Decouple unit test, remove intermediate unittestbridge package (#17662) 2021-11-16 16:53:21 +08:00
api_wiki_test.go Add API to get/edit wiki (#17278) 2021-10-25 11:43:40 +08:00
attachment_test.go
auth_ldap_test.go
benchmarks_test.go Decouple unit test, remove intermediate unittestbridge package (#17662) 2021-11-16 16:53:21 +08:00
branches_test.go Frontend refactor, PascalCase to camelCase, remove unused code (#17365) 2021-10-21 15:37:43 +08:00
change_default_branch_test.go Decouple unit test, remove intermediate unittestbridge package (#17662) 2021-11-16 16:53:21 +08:00
cmd_keys_test.go
compare_test.go Prevent NPE on invalid diff (#17197) 2021-09-30 21:31:02 +02:00
cors_test.go
create_no_session_test.go refactor: move from io/ioutil to io and os package (#17109) 2021-09-22 13:38:34 +08:00
delete_user_test.go Decouple unit test, remove intermediate unittestbridge package (#17662) 2021-11-16 16:53:21 +08:00
download_test.go
editor_test.go
empty_repo_test.go Decouple unit test, remove intermediate unittestbridge package (#17662) 2021-11-16 16:53:21 +08:00
eventsource_test.go Decouple unit test, remove intermediate unittestbridge package (#17662) 2021-11-16 16:53:21 +08:00
explore_repos_test.go
git_clone_wiki_test.go refactor: move from io/ioutil to io and os package (#17109) 2021-09-22 13:38:34 +08:00
git_helper_for_declarative_test.go Fix ipv6 parsing for builtin ssh server (#17561) 2021-11-06 14:23:32 +08:00
git_smart_http_test.go refactor: move from io/ioutil to io and os package (#17109) 2021-09-22 13:38:34 +08:00
git_test.go Decouple unit test, remove intermediate unittestbridge package (#17662) 2021-11-16 16:53:21 +08:00
goget_test.go
gpg_git_test.go Decouple unit test, remove intermediate unittestbridge package (#17662) 2021-11-16 16:53:21 +08:00
html_helper.go Frontend refactor, PascalCase to camelCase, remove unused code (#17365) 2021-10-21 15:37:43 +08:00
integration_test.go Decouple unit test, remove intermediate unittestbridge package (#17662) 2021-11-16 16:53:21 +08:00
issue_test.go Multiple Escaping Improvements (#17551) 2021-11-16 18:18:25 +00:00
lfs_getobject_test.go refactor: move from io/ioutil to io and os package (#17109) 2021-09-22 13:38:34 +08:00
lfs_local_endpoint_test.go refactor: move from io/ioutil to io and os package (#17109) 2021-09-22 13:38:34 +08:00
links_test.go Multiple Escaping Improvements (#17551) 2021-11-16 18:18:25 +00:00
migrate_test.go Move migrations into services and base into modules/migration (#17663) 2021-11-16 23:25:33 +08:00
mirror_pull_test.go Move migrations into services and base into modules/migration (#17663) 2021-11-16 23:25:33 +08:00
mirror_push_test.go Decouple unit test, remove intermediate unittestbridge package (#17662) 2021-11-16 16:53:21 +08:00
mssql.ini.tmpl
mysql.ini.tmpl
mysql8.ini.tmpl
nonascii_branches_test.go Multiple Escaping Improvements (#17551) 2021-11-16 18:18:25 +00:00
oauth_test.go refactor: move from io/ioutil to io and os package (#17109) 2021-09-22 13:38:34 +08:00
org_count_test.go Decouple unit test, remove intermediate unittestbridge package (#17662) 2021-11-16 16:53:21 +08:00
org_test.go Ensure that restricted users can access repos for which they are members (#17460) 2021-10-28 10:54:40 +08:00
pgsql.ini.tmpl
private-testing.key
privateactivity_test.go Decouple unit test, remove intermediate unittestbridge package (#17662) 2021-11-16 16:53:21 +08:00
pull_compare_test.go
pull_create_test.go Frontend refactor, PascalCase to camelCase, remove unused code (#17365) 2021-10-21 15:37:43 +08:00
pull_merge_test.go Decouple unit test, remove intermediate unittestbridge package (#17662) 2021-11-16 16:53:21 +08:00
pull_review_test.go
pull_status_test.go
pull_update_test.go Move some functions into services/repository (#17660) 2021-11-16 21:30:11 +08:00
README.md
README_ZH.md
release_test.go Decouple unit test, remove intermediate unittestbridge package (#17662) 2021-11-16 16:53:21 +08:00
rename_branch_test.go Decouple unit test, remove intermediate unittestbridge package (#17662) 2021-11-16 16:53:21 +08:00
repo_activity_test.go Fix activity count in TestRepoActivity (#9959) 2020-01-24 13:06:40 +00:00
repo_branch_test.go
repo_commits_search_test.go
repo_commits_test.go
repo_fork_test.go Decouple unit test, remove intermediate unittestbridge package (#17662) 2021-11-16 16:53:21 +08:00
repo_generate_test.go Decouple unit test, remove intermediate unittestbridge package (#17662) 2021-11-16 16:53:21 +08:00
repo_migrate_test.go
repo_search_test.go Make Repo Code Indexer an Unique Queue (#17515) 2021-11-02 11:14:24 +08:00
repo_tag_test.go Decouple unit test, remove intermediate unittestbridge package (#17662) 2021-11-16 16:53:21 +08:00
repo_test.go
repo_watch_test.go Decouple unit test, remove intermediate unittestbridge package (#17662) 2021-11-16 16:53:21 +08:00
repofiles_delete_test.go Decouple unit test code from business code (#17623) 2021-11-12 22:36:47 +08:00
repofiles_update_test.go
setting_test.go
signin_test.go Decouple unit test, remove intermediate unittestbridge package (#17662) 2021-11-16 16:53:21 +08:00
signout_test.go
signup_test.go Decouple unit test, remove intermediate unittestbridge package (#17662) 2021-11-16 16:53:21 +08:00
sqlite.ini.tmpl
ssh_key_test.go refactor: move from io/ioutil to io and os package (#17109) 2021-09-22 13:38:34 +08:00
testlogger.go
timetracking_test.go
user_avatar_test.go Decouple unit test, remove intermediate unittestbridge package (#17662) 2021-11-16 16:53:21 +08:00
user_test.go Decouple unit test, remove intermediate unittestbridge package (#17662) 2021-11-16 16:53:21 +08:00
version_test.go
view_test.go
xss_test.go Decouple unit test, remove intermediate unittestbridge package (#17662) 2021-11-16 16:53:21 +08:00

Integrations tests

Integration tests can be run with make commands for the appropriate backends, namely:

make test-mysql
make test-pgsql
make test-sqlite

Make sure to perform a clean build before running tests:

make clean build

Run all tests via local drone

drone exec --local --build-event "pull_request"

Run sqlite integrations tests

Start tests

make test-sqlite

Run mysql integrations tests

Setup a mysql database inside docker

docker run -e "MYSQL_DATABASE=test" -e "MYSQL_ALLOW_EMPTY_PASSWORD=yes" -p 3306:3306 --rm --name mysql mysql:latest #(just ctrl-c to stop db and clean the container)
docker run -p 9200:9200 -p 9300:9300 -e "discovery.type=single-node" --rm --name elasticsearch elasticsearch:7.6.0 #(in a second terminal, just ctrl-c to stop db and clean the container)

Start tests based on the database container

TEST_MYSQL_HOST=localhost:3306 TEST_MYSQL_DBNAME=test TEST_MYSQL_USERNAME=root TEST_MYSQL_PASSWORD='' make test-mysql

Run pgsql integrations tests

Setup a pgsql database inside docker

docker run -e "POSTGRES_DB=test" -p 5432:5432 --rm --name pgsql postgres:latest #(just ctrl-c to stop db and clean the container)

Start tests based on the database container

TEST_PGSQL_HOST=localhost:5432 TEST_PGSQL_DBNAME=test TEST_PGSQL_USERNAME=postgres TEST_PGSQL_PASSWORD=postgres make test-pgsql

Run mssql integrations tests

Setup a mssql database inside docker

docker run -e "ACCEPT_EULA=Y" -e "MSSQL_PID=Standard" -e "SA_PASSWORD=MwantsaSecurePassword1" -p 1433:1433 --rm --name mssql microsoft/mssql-server-linux:latest #(just ctrl-c to stop db and clean the container)

Start tests based on the database container

TEST_MSSQL_HOST=localhost:1433 TEST_MSSQL_DBNAME=gitea_test TEST_MSSQL_USERNAME=sa TEST_MSSQL_PASSWORD=MwantsaSecurePassword1 make test-mssql

Running individual tests

Example command to run GPG test:

For sqlite:

make test-sqlite#GPG

For other databases(replace MSSQL to MYSQL, MYSQL8, PGSQL):

TEST_MSSQL_HOST=localhost:1433 TEST_MSSQL_DBNAME=test TEST_MSSQL_USERNAME=sa TEST_MSSQL_PASSWORD=MwantsaSecurePassword1 make test-mssql#GPG

Setting timeouts for declaring long-tests and long-flushes

We appreciate that some testing machines may not be very powerful and the default timeouts for declaring a slow test or a slow clean-up flush may not be appropriate.

You can either:

  • Within the test ini file set the following section:
[integration-tests]
SLOW_TEST = 10s ; 10s is the default value
SLOW_FLUSH = 5S ; 5s is the default value
  • Set the following environment variables:
GITEA_SLOW_TEST_TIME="10s" GITEA_SLOW_FLUSH_TIME="5s" make test-sqlite