mirror of
https://github.com/go-gitea/gitea.git
synced 2026-10-26 06:16:56 +09:00
42b1f95261
Bound the memory used when parsing uploaded packages, so instances with low memory limits survive non-standard packages. 1. Metadata files are read through a size-limited reader, archives themselves stay unbounded so large payloads keep working 2. zstd decoding caps the window at 128 MiB, the zstd CLI default 3. RPM headers go through a first-party reader with rpmlib's size and array count limits that allocates only what the upload contains, until https://github.com/sassoftware/go-rpmutils/pull/44 is released. Signing still verifies the payload digest, and its signature header matches rpmsign's byte for byte 4. Swift and NuGet read the zip entry they size-checked, a duplicate name could stand in for it before 5. Terraform states check `LIMIT_SIZE_TERRAFORM_STATE` before parsing, NuGet symbol PDBs share a 256 MiB budget 6. Oversized container configs are rejected instead of stored without metadata, invalid Vagrant boxes answer 400 instead of 500 Signed-off-by: techknowlogick <git@tklk.dev> Co-authored-by: techknowlogick <git@tklk.dev> Co-authored-by: silverwind <me@silverwind.io> Co-authored-by: techknowlogick <techknowlogick@gitea.com>
73 lines
2.9 KiB
Go
73 lines
2.9 KiB
Go
// Copyright 2022 The Gitea Authors. All rights reserved.
|
|
// SPDX-License-Identifier: MIT
|
|
|
|
package container
|
|
|
|
import (
|
|
"strings"
|
|
"testing"
|
|
|
|
"gitea.dev/modules/packages"
|
|
"gitea.dev/modules/packages/container/helm"
|
|
|
|
oci "github.com/opencontainers/image-spec/specs-go/v1"
|
|
"github.com/stretchr/testify/assert"
|
|
"github.com/stretchr/testify/require"
|
|
)
|
|
|
|
func TestParseImageConfig(t *testing.T) {
|
|
description := "Image Description"
|
|
author := "Gitea"
|
|
license := "MIT"
|
|
projectURL := "https://gitea.com"
|
|
repositoryURL := "https://gitea.com/gitea"
|
|
documentationURL := "https://docs.gitea.com"
|
|
|
|
// FIXME: JSON-KEY-CASE: the test case is not right, the config fields are capitalized in the spec
|
|
// https://github.com/opencontainers/image-spec/blob/main/schema/config-schema.json
|
|
configOCI := `{"config": {"labels": {"` + labelAuthors + `": "` + author + `", "` + labelLicenses + `": "` + license + `", "` + labelURL + `": "` + projectURL + `", "` + labelSource + `": "` + repositoryURL + `", "` + labelDocumentation + `": "` + documentationURL + `", "` + labelDescription + `": "` + description + `"}}, "history": [{"created_by": "do it 1"}, {"created_by": "dummy #(nop) do it 2"}]}`
|
|
|
|
metadata, err := ParseImageConfig(oci.MediaTypeImageManifest, strings.NewReader(configOCI))
|
|
assert.NoError(t, err)
|
|
|
|
assert.Equal(t, TypeOCI, metadata.Type)
|
|
assert.Equal(t, description, metadata.Description)
|
|
assert.ElementsMatch(t, []string{author}, metadata.Authors)
|
|
assert.Equal(t, license, metadata.Licenses)
|
|
assert.Equal(t, projectURL, metadata.ProjectURL)
|
|
assert.Equal(t, repositoryURL, metadata.RepositoryURL)
|
|
assert.Equal(t, documentationURL, metadata.DocumentationURL)
|
|
assert.ElementsMatch(t, []string{"do it 1", "do it 2"}, metadata.ImageLayers)
|
|
assert.Equal(
|
|
t,
|
|
map[string]string{
|
|
labelAuthors: author,
|
|
labelLicenses: license,
|
|
labelURL: projectURL,
|
|
labelSource: repositoryURL,
|
|
labelDocumentation: documentationURL,
|
|
labelDescription: description,
|
|
},
|
|
metadata.Labels,
|
|
)
|
|
assert.Empty(t, metadata.Manifests)
|
|
|
|
configHelm := `{"description":"` + description + `", "home": "` + projectURL + `", "sources": ["` + repositoryURL + `"], "maintainers":[{"name":"` + author + `"}]}`
|
|
|
|
metadata, err = ParseImageConfig(helm.ConfigMediaType, strings.NewReader(configHelm))
|
|
assert.NoError(t, err)
|
|
|
|
assert.Equal(t, TypeHelm, metadata.Type)
|
|
assert.Equal(t, description, metadata.Description)
|
|
assert.ElementsMatch(t, []string{author}, metadata.Authors)
|
|
assert.Equal(t, projectURL, metadata.ProjectURL)
|
|
assert.Equal(t, repositoryURL, metadata.RepositoryURL)
|
|
|
|
metadata, err = ParseImageConfig("anything-unknown", strings.NewReader(""))
|
|
require.NoError(t, err)
|
|
assert.Equal(t, &Metadata{Platform: "unknown/unknown"}, metadata)
|
|
|
|
_, err = ParseImageConfig(oci.MediaTypeImageConfig, strings.NewReader(`{"history": [{"created_by": "`+strings.Repeat("a", maxImageConfigSize)+`"}]}`))
|
|
assert.ErrorIs(t, err, packages.ErrContentTooLarge)
|
|
}
|