public/gitea
1
0
Fork 0
mirror of https://github.com/go-gitea/gitea.git synced 2025-10-24 13:53:42 +09:00
Code Issues Packages Projects Releases Wiki Activity

fix attachment file size limit in server backend (#35519)

Browse Source 
fix #35512

---------

Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
This commit is contained in:
a1012112796
2025-10-21 23:07:11 +08:00
committed by GitHub
parent 3917d27467
commit a4e23b81d3
18 changed files with 169 additions and 109 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
tests/integration/api_comment_attachment_test.go
View File

@@ -6,7 +6,6 @@ package integration
import (
"bytes"
"fmt"
"io"
"mime/multipart"
"net/http"
"testing"
@@ -95,15 +94,13 @@ func TestAPICreateCommentAttachment(t *testing.T) {
session := loginUser(t, repoOwner.Name)
token := getTokenForLoggedInUser(t, session, auth_model.AccessTokenScopeWriteIssue)
filename := "image.png"
buff := generateImg()
body := &bytes.Buffer{}
// Setup multi-part
writer := multipart.NewWriter(body)
part, err := writer.CreateFormFile("attachment", filename)
part, err := writer.CreateFormFile("attachment", "image.png")
assert.NoError(t, err)
_, err = io.Copy(part, &buff)
_, err = part.Write(testGeneratePngBytes())
assert.NoError(t, err)
err = writer.Close()
assert.NoError(t, err)

7
tests/integration/api_issue_attachment_test.go
View File

@@ -6,7 +6,6 @@ package integration
import (
"bytes"
"fmt"
"io"
"mime/multipart"
"net/http"
"testing"
@@ -72,15 +71,13 @@ func TestAPICreateIssueAttachment(t *testing.T) {
session := loginUser(t, repoOwner.Name)
token := getTokenForLoggedInUser(t, session, auth_model.AccessTokenScopeWriteIssue)
filename := "image.png"
buff := generateImg()
body := &bytes.Buffer{}
// Setup multi-part
writer := multipart.NewWriter(body)
part, err := writer.CreateFormFile("attachment", filename)
part, err := writer.CreateFormFile("attachment", "image.png")
assert.NoError(t, err)
_, err = io.Copy(part, &buff)
_, err = part.Write(testGeneratePngBytes())
assert.NoError(t, err)
err = writer.Close()
assert.NoError(t, err)

82
tests/integration/api_releases_test.go
View File

@@ -9,6 +9,7 @@ import (
"io"
"mime/multipart"
"net/http"
"net/http/httptest"
"net/url"
"strings"
"testing"
@@ -18,7 +19,9 @@ import (
"code.gitea.io/gitea/models/unittest"
user_model "code.gitea.io/gitea/models/user"
"code.gitea.io/gitea/modules/gitrepo"
"code.gitea.io/gitea/modules/setting"
api "code.gitea.io/gitea/modules/structs"
"code.gitea.io/gitea/modules/test"
"code.gitea.io/gitea/tests"
"github.com/stretchr/testify/assert"
@@ -294,67 +297,70 @@ func TestAPIDeleteReleaseByTagName(t *testing.T) {
func TestAPIUploadAssetRelease(t *testing.T) {
defer tests.PrepareTestEnv(t)()
defer test.MockVariableValue(&setting.Attachment.MaxSize, 1)()
repo := unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: 1})
owner := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: repo.OwnerID})
session := loginUser(t, owner.LowerName)
token := getTokenForLoggedInUser(t, session, auth_model.AccessTokenScopeWriteRepository)
r := createNewReleaseUsingAPI(t, token, owner, repo, "release-tag", "", "Release Tag", "test")
bufImageBytes := testGeneratePngBytes()
bufLargeBytes := bytes.Repeat([]byte{' '}, 2*1024*1024)
filename := "image.png"
buff := generateImg()
assetURL := fmt.Sprintf("/api/v1/repos/%s/%s/releases/%d/assets", owner.Name, repo.Name, r.ID)
release := createNewReleaseUsingAPI(t, token, owner, repo, "release-tag", "", "Release Tag", "test")
assetURL := fmt.Sprintf("/api/v1/repos/%s/%s/releases/%d/assets", owner.Name, repo.Name, release.ID)
t.Run("multipart/form-data", func(t *testing.T) {
defer tests.PrintCurrentTest(t)()
const filename = "image.png"
body := &bytes.Buffer{}
performUpload := func(t *testing.T, uploadURL string, buf []byte, expectedStatus int) *httptest.ResponseRecorder {
body := &bytes.Buffer{}
writer := multipart.NewWriter(body)
part, err := writer.CreateFormFile("attachment", filename)
assert.NoError(t, err)
_, err = io.Copy(part, bytes.NewReader(bufImageBytes))
assert.NoError(t, err)
err = writer.Close()
assert.NoError(t, err)
writer := multipart.NewWriter(body)
part, err := writer.CreateFormFile("attachment", filename)
assert.NoError(t, err)
_, err = io.Copy(part, bytes.NewReader(buff.Bytes()))
assert.NoError(t, err)
err = writer.Close()
assert.NoError(t, err)
req := NewRequestWithBody(t, http.MethodPost, uploadURL, bytes.NewReader(body.Bytes())).
AddTokenAuth(token).
SetHeader("Content-Type", writer.FormDataContentType())
return MakeRequest(t, req, http.StatusCreated)
}
req := NewRequestWithBody(t, http.MethodPost, assetURL, bytes.NewReader(body.Bytes())).
AddTokenAuth(token).
SetHeader("Content-Type", writer.FormDataContentType())
resp := MakeRequest(t, req, http.StatusCreated)
performUpload(t, assetURL, bufLargeBytes, http.StatusRequestEntityTooLarge)
var attachment *api.Attachment
DecodeJSON(t, resp, &attachment)
assert.Equal(t, filename, attachment.Name)
assert.EqualValues(t, 104, attachment.Size)
req = NewRequestWithBody(t, http.MethodPost, assetURL+"?name=test-asset", bytes.NewReader(body.Bytes())).
AddTokenAuth(token).
SetHeader("Content-Type", writer.FormDataContentType())
resp = MakeRequest(t, req, http.StatusCreated)
var attachment2 *api.Attachment
DecodeJSON(t, resp, &attachment2)
assert.Equal(t, "test-asset", attachment2.Name)
assert.EqualValues(t, 104, attachment2.Size)
t.Run("UploadDefaultName", func(t *testing.T) {
resp := performUpload(t, assetURL, bufImageBytes, http.StatusCreated)
var attachment api.Attachment
DecodeJSON(t, resp, &attachment)
assert.Equal(t, filename, attachment.Name)
assert.EqualValues(t, 104, attachment.Size)
})
t.Run("UploadWithName", func(t *testing.T) {
resp := performUpload(t, assetURL+"?name=test-asset", bufImageBytes, http.StatusCreated)
var attachment api.Attachment
DecodeJSON(t, resp, &attachment)
assert.Equal(t, "test-asset", attachment.Name)
assert.EqualValues(t, 104, attachment.Size)
})
})
t.Run("application/octet-stream", func(t *testing.T) {
defer tests.PrintCurrentTest(t)()
req := NewRequestWithBody(t, http.MethodPost, assetURL, bytes.NewReader(buff.Bytes())).
AddTokenAuth(token)
req := NewRequestWithBody(t, http.MethodPost, assetURL, bytes.NewReader(bufImageBytes)).AddTokenAuth(token)
MakeRequest(t, req, http.StatusBadRequest)
req = NewRequestWithBody(t, http.MethodPost, assetURL+"?name=stream.bin", bytes.NewReader(buff.Bytes())).
AddTokenAuth(token)
req = NewRequestWithBody(t, http.MethodPost, assetURL+"?name=stream.bin", bytes.NewReader(bufLargeBytes)).AddTokenAuth(token)
MakeRequest(t, req, http.StatusRequestEntityTooLarge)
req = NewRequestWithBody(t, http.MethodPost, assetURL+"?name=stream.bin", bytes.NewReader(bufImageBytes)).AddTokenAuth(token)
resp := MakeRequest(t, req, http.StatusCreated)
var attachment *api.Attachment
var attachment api.Attachment
DecodeJSON(t, resp, &attachment)
assert.Equal(t, "stream.bin", attachment.Name)

16
tests/integration/attachment_test.go
View File

@@ -7,7 +7,6 @@ import (
"bytes"
"image"
"image/png"
"io"
"mime/multipart"
"net/http"
"strings"
@@ -21,22 +20,21 @@ import (
"github.com/stretchr/testify/assert"
)
func generateImg() bytes.Buffer {
// Generate image
func testGeneratePngBytes() []byte {
myImage := image.NewRGBA(image.Rect(0, 0, 32, 32))
var buff bytes.Buffer
png.Encode(&buff, myImage)
return buff
_ = png.Encode(&buff, myImage)
return buff.Bytes()
}
func createAttachment(t *testing.T, session *TestSession, csrf, repoURL, filename string, buff bytes.Buffer, expectedStatus int) string {
func testCreateIssueAttachment(t *testing.T, session *TestSession, csrf, repoURL, filename string, content []byte, expectedStatus int) string {
body := &bytes.Buffer{}
// Setup multi-part
writer := multipart.NewWriter(body)
part, err := writer.CreateFormFile("file", filename)
assert.NoError(t, err)
_, err = io.Copy(part, &buff)
_, err = part.Write(content)
assert.NoError(t, err)
err = writer.Close()
assert.NoError(t, err)
@@ -57,14 +55,14 @@ func createAttachment(t *testing.T, session *TestSession, csrf, repoURL, filenam
func TestCreateAnonymousAttachment(t *testing.T) {
defer tests.PrepareTestEnv(t)()
session := emptyTestSession(t)
createAttachment(t, session, GetAnonymousCSRFToken(t, session), "user2/repo1", "image.png", generateImg(), http.StatusSeeOther)
testCreateIssueAttachment(t, session, GetAnonymousCSRFToken(t, session), "user2/repo1", "image.png", testGeneratePngBytes(), http.StatusSeeOther)
}
func TestCreateIssueAttachment(t *testing.T) {
defer tests.PrepareTestEnv(t)()
const repoURL = "user2/repo1"
session := loginUser(t, "user2")
uuid := createAttachment(t, session, GetUserCSRFToken(t, session), repoURL, "image.png", generateImg(), http.StatusOK)
uuid := testCreateIssueAttachment(t, session, GetUserCSRFToken(t, session), repoURL, "image.png", testGeneratePngBytes(), http.StatusOK)
req := NewRequest(t, "GET", repoURL+"/issues/new")
resp := session.MakeRequest(t, req, http.StatusOK)