Ensure valid git author names passed in signatures #5774
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
This should probably be backported to at least v1.7. |
bkcsoft
added
the
lgtm/need 2
Codecov Report
@@ Coverage Diff @@
## master #5774 +/- ##
==========================================
+ Coverage 37.88% 37.89% +0.01%
==========================================
Files 328 328
Lines 48260 48273 +13
==========================================
+ Hits 18282 18292 +10
- Misses 27347 27351 +4
+ Partials 2631 2630 -1
Continue to review full report at Codecov.
|
|
Might need some Tests ???? |
techknowlogick
approved these changes
Jan 19, 2019
bkcsoft
added
lgtm/need 1
techknowlogick
approved these changes
Jan 19, 2019
lunny
requested changes
Jan 20, 2019
Fix go-gitea#5772 - Git author names are not allowed to include `\n` `<` or `>` and must not be empty. Ensure that the name passed in a signature is valid. Signed-off-by: Andrew Thornton <[email protected]>
LDAP and the like usernames are not checked in the same way that users who signup are. Therefore just ensure that user names are also git safe and if totally pathological - Set them to "user-$UID" Signed-off-by: Andrew Thornton <[email protected]>
Make our testcases a little more pathological so that we be sure that integration tests have a chance to spot these cases. Signed-off-by: Andrew Thornton <[email protected]>
zeripath
force-pushed
the
issue-5772-escape-full-name-in-git-author
branch
from
740c1f5
to
1ae279a
Compare
|
OK tests are up. I've made the test fixtures for user a little more pathological. We should try to make our test fixtures a bit more pathological in general. |
zeripath
added a commit
to zeripath/gitea
that referenced
this pull request
Jan 20, 2019
see go-gitea#5774 Signed-off-by: Andrew Thornton <[email protected]>
lafriks
reviewed
Jan 20, 2019
Signed-off-by: Andrew Thornton <[email protected]>
|
I'm ok with changes, needs @lunny approval |
lunny
approved these changes
Jan 24, 2019
bkcsoft
added
lgtm/done
bmackinney
pushed a commit
to bmackinney/gitea
that referenced
this pull request
Jan 27, 2019
* Ensure valid git author names passed in signatures Fix go-gitea#5772 - Git author names are not allowed to include `\n` `<` or `>` and must not be empty. Ensure that the name passed in a signature is valid. * Account for pathologically named external users LDAP and the like usernames are not checked in the same way that users who signup are. Therefore just ensure that user names are also git safe and if totally pathological - Set them to "user-$UID" * Add Tests and adjust test users Make our testcases a little more pathological so that we be sure that integration tests have a chance to spot these cases. Signed-off-by: Andrew Thornton <[email protected]>
6 tasks
lafriks
pushed a commit
that referenced
this pull request
Feb 12, 2019
… LFS support (#5702) * Use git plumbing for upload: #5621 repo_editor.go: UploadRepoFile * Use git plumbing for upload: #5621 repo_editor.go: GetDiffPreview * Use git plumbing for upload: #5621 repo_editor.go: DeleteRepoFile * Use git plumbing for upload: #5621 repo_editor.go: UploadRepoFiles * Move branch checkout functions out of repo_editor.go as they are no longer used there * BUGFIX: The default permissions should be 100644 This is a change from the previous code but is more in keeping with the default behaviour of git. Signed-off-by: Andrew Thornton <[email protected]> * Standardise cleanUploadFilename to more closely match git See verify_path in: https://github.com/git/git/blob/7f4e64169352e03476b0ea64e7e2973669e491a2/read-cache.c#L951 Signed-off-by: Andrew Thornton <[email protected]> * Redirect on bad paths Signed-off-by: Andrew Thornton <[email protected]> * Refactor to move the uploading functions out to a module Signed-off-by: Andrew Thornton <[email protected]> * Add LFS support Signed-off-by: Andrew Thornton <[email protected]> * Update upload.go attribution header Upload.go is essentially the remnants of repo_editor.go. The remaining code is essentially unchanged from the Gogs code, hence the Gogs attribution. * Delete upload files after session committed * Ensure that GIT_AUTHOR_NAME etc. are valid for git see #5774 Signed-off-by: Andrew Thornton <[email protected]> * Add in test cases per @lafriks comment * Add space between gitea and github imports Signed-off-by: Andrew Thornton <[email protected]> * more examples in TestCleanUploadName Signed-off-by: Andrew Thornton <[email protected]> * fix formatting Signed-off-by: Andrew Thornton <[email protected]> * Set the SSH_ORIGINAL_COMMAND to ensure hooks are run Signed-off-by: Andrew Thornton <[email protected]> * Switch off SSH_ORIGINAL_COMMAND Signed-off-by: Andrew Thornton <[email protected]>
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Fix #5772 - Git author names are not allowed to include
\n<or>andmust not be empty. Ensure that the name passed in a signature is valid.
Signed-off-by: Andrew Thornton [email protected]