public/gitea
1
0
Fork 0
mirror of https://github.com/go-gitea/gitea.git synced 2026-10-09 04:30:16 +09:00
Code Issues Packages Projects Releases Wiki Activity

fix: sanitize external render command line arguments (#39417)

Browse Source
This commit is contained in:
wxiaoguang
2026-09-25 01:38:00 +08:00
committed by GitHub
parent d5ed7375ce
commit 671a2f5dc0
2 changed files with 102 additions and 23 deletions
Download Patch File Download Diff File Expand all files Collapse all files
modules/markup/external/external_test.go
Vendored
+27 -9
View File
@@ -12,13 +12,31 @@ import (
)
func TestPrepareExternalCommand(t *testing.T) {
r := &Renderer{MarkupRenderer: &setting.MarkupRenderer{Command: ""}}
_, _, err := r.prepareExternalCommand(map[string]string{"KEY": "val"})
assert.ErrorContains(t, err, "no command")
r = &Renderer{MarkupRenderer: &setting.MarkupRenderer{Command: `"/foo bar/bin" --opt $KEY "$KEY" %KEY% other`}}
prog, args, err := r.prepareExternalCommand(map[string]string{"KEY": `a"b`})
assert.NoError(t, err)
assert.Equal(t, "/foo bar/bin", prog)
assert.Equal(t, []string{"--opt", `a"b`, `a"b`, `a"b`, "other"}, args)
t.Run("NoCommand", func(t *testing.T) {
r := &Renderer{MarkupRenderer: &setting.MarkupRenderer{Command: ""}}
_, _, err := r.prepareExternalCommand(map[string]string{"KEY": "val"})
assert.ErrorContains(t, err, "no command")
})
t.Run("ReplaceArgs", func(t *testing.T) {
r := &Renderer{MarkupRenderer: &setting.MarkupRenderer{Command: `"/foo bar/bin" --opt $KEY "$KEY" %KEY% other`}}
prog, args, err := r.prepareExternalCommand(map[string]string{"KEY": `a"b`})
assert.NoError(t, err)
assert.Equal(t, "/foo bar/bin", prog)
assert.Equal(t, []string{"--opt", `a"b`, `a"b`, `a"b`, "other"}, args)
})
}
func TestPrepare(t *testing.T) {
t.Run("Valid", func(t *testing.T) {
r := &Renderer{MarkupRenderer: &setting.MarkupRenderer{Command: "foo $GITEA_PREFIX_SRC $GITEA_PREFIX_RAW"}}
ret, err := r.prepare("https://example.com/src", "https://example.com/raw")
assert.NoError(t, err)
assert.Equal(t, []string{"https://example.com/src", "https://example.com/raw"}, ret.args)
})
t.Run("Sanitized", func(t *testing.T) {
r := &Renderer{MarkupRenderer: &setting.MarkupRenderer{Command: "foo $GITEA_PREFIX_SRC $GITEA_PREFIX_RAW"}}
ret, err := r.prepare("https://[::1%25foo]:3000/a%2fb/x$y", "https://$foo.com")
assert.NoError(t, err)
assert.Equal(t, []string{"https://[::1%25foo]:3000/a%2fb/x%24y", ""}, ret.args)
})
}