mirror of
https://github.com/hanzoai/forge.git
synced 2026-10-30 15:00:39 +00:00
zeekayandHanzo Dev
9a07b4d089
2978 files. The fork is 2026-07-15 (rebrand: gitea.dev -> github.com/hanzoai/git), so 2026 is the year, and "Copyright 2026 Hanzo AI, Inc." was already the form used by the handful of files that had ours. Shape is now: // Copyright 2026 Hanzo AI, Inc. All rights reserved. // Copyright 2015 The Gogs Authors. All rights reserved. // Copyright 2019 The Gitea Authors. All rights reserved. // SPDX-License-Identifier: MIT Ours on top, theirs retained verbatim. Retained because MIT requires it, and separately because they are true — those authors did write that code. Not renamed to "The Git Authors": Git is a different project under a different license, and putting its name here would attribute this code to people who have nothing to do with it. Adding our line is the fix; overwriting theirs would have been both a licence violation and a false statement. gofmt still reports import-order drift in some of these files. It predates this change (verified against a stash) and is left alone rather than burying a one-line-per-file legal change under 3000 files of unrelated reordering. Build clean. Co-authored-by: Hanzo Dev <[email protected]>
211 lines
7.4 KiB
Go
211 lines
7.4 KiB
Go
// Copyright 2026 Hanzo AI, Inc. All rights reserved.
|
|
// Copyright 2023 The Gitea Authors. All rights reserved.
|
|
// SPDX-License-Identifier: MIT
|
|
|
|
package httplib
|
|
|
|
import (
|
|
"context"
|
|
"crypto/tls"
|
|
"net/http"
|
|
"testing"
|
|
|
|
"github.com/hanzoai/git/modules/setting"
|
|
"github.com/hanzoai/git/modules/test"
|
|
|
|
"github.com/stretchr/testify/assert"
|
|
)
|
|
|
|
func TestIsRelativeURL(t *testing.T) {
|
|
defer test.MockVariableValue(&setting.AppURL, "http://localhost:3000/sub/")()
|
|
defer test.MockVariableValue(&setting.AppSubURL, "/sub")()
|
|
rel := []string{
|
|
"",
|
|
"foo",
|
|
"/",
|
|
"/foo?k=%20#abc",
|
|
"/foo?k=\\",
|
|
}
|
|
for _, s := range rel {
|
|
assert.True(t, IsRelativeURL(s), "rel = %q", s)
|
|
}
|
|
abs := []string{
|
|
"//",
|
|
"\\\\",
|
|
"/\\",
|
|
"\\/",
|
|
"/a/../\\b",
|
|
"/any\\thing",
|
|
"mailto:[email protected]",
|
|
"https://test.com",
|
|
}
|
|
for _, s := range abs {
|
|
assert.False(t, IsRelativeURL(s), "abs = %q", s)
|
|
}
|
|
}
|
|
|
|
func TestGuessCurrentHostURL(t *testing.T) {
|
|
defer test.MockVariableValue(&setting.AppURL, "http://cfg-host/sub/")()
|
|
defer test.MockVariableValue(&setting.AppSubURL, "/sub")()
|
|
headersWithProto := http.Header{"X-Forwarded-Proto": {"https"}}
|
|
maliciousProtoHeaders := http.Header{"X-Forwarded-Proto": {"http://attacker.host/?trash="}}
|
|
|
|
t.Run("Legacy", func(t *testing.T) {
|
|
defer test.MockVariableValue(&setting.PublicURLDetection, setting.PublicURLLegacy)()
|
|
|
|
assert.Equal(t, "http://cfg-host", GuessCurrentHostURL(t.Context()))
|
|
|
|
// legacy: "Host" is not used when there is no "X-Forwarded-Proto" header
|
|
ctx := context.WithValue(t.Context(), RequestContextKey, &http.Request{Host: "req-host:3000"})
|
|
assert.Equal(t, "http://cfg-host", GuessCurrentHostURL(ctx))
|
|
|
|
// if "X-Forwarded-Proto" exists, then use it and "Host" header
|
|
ctx = context.WithValue(t.Context(), RequestContextKey, &http.Request{Host: "req-host:3000", Header: headersWithProto})
|
|
assert.Equal(t, "https://req-host:3000", GuessCurrentHostURL(ctx))
|
|
|
|
ctx = context.WithValue(t.Context(), RequestContextKey, &http.Request{Host: "req-host:3000", Header: maliciousProtoHeaders})
|
|
assert.Equal(t, "http://cfg-host", GuessCurrentHostURL(ctx))
|
|
})
|
|
|
|
t.Run("Auto", func(t *testing.T) {
|
|
defer test.MockVariableValue(&setting.PublicURLDetection, setting.PublicURLAuto)()
|
|
|
|
assert.Equal(t, "http://cfg-host", GuessCurrentHostURL(t.Context()))
|
|
|
|
// auto: always use "Host" header, the scheme is determined by "X-Forwarded-Proto" header, or TLS config if no "X-Forwarded-Proto" header
|
|
ctx := context.WithValue(t.Context(), RequestContextKey, &http.Request{Host: "req-host:3000"})
|
|
assert.Equal(t, "http://req-host:3000", GuessCurrentHostURL(ctx))
|
|
|
|
ctx = context.WithValue(t.Context(), RequestContextKey, &http.Request{Host: "req-host", TLS: &tls.ConnectionState{}})
|
|
assert.Equal(t, "https://req-host", GuessCurrentHostURL(ctx))
|
|
|
|
ctx = context.WithValue(t.Context(), RequestContextKey, &http.Request{Host: "req-host:3000", Header: headersWithProto})
|
|
assert.Equal(t, "https://req-host:3000", GuessCurrentHostURL(ctx))
|
|
|
|
ctx = context.WithValue(t.Context(), RequestContextKey, &http.Request{Host: "req-host:3000", Header: maliciousProtoHeaders})
|
|
assert.Equal(t, "http://req-host:3000", GuessCurrentHostURL(ctx))
|
|
})
|
|
|
|
t.Run("Never", func(t *testing.T) {
|
|
defer test.MockVariableValue(&setting.PublicURLDetection, setting.PublicURLNever)()
|
|
|
|
assert.Equal(t, "http://cfg-host", GuessCurrentHostURL(t.Context()))
|
|
|
|
ctx := context.WithValue(t.Context(), RequestContextKey, &http.Request{Host: "req-host:3000"})
|
|
assert.Equal(t, "http://cfg-host", GuessCurrentHostURL(ctx))
|
|
|
|
ctx = context.WithValue(t.Context(), RequestContextKey, &http.Request{Host: "req-host:3000", TLS: &tls.ConnectionState{}})
|
|
assert.Equal(t, "http://cfg-host", GuessCurrentHostURL(ctx))
|
|
|
|
ctx = context.WithValue(t.Context(), RequestContextKey, &http.Request{Host: "req-host:3000", Header: headersWithProto})
|
|
assert.Equal(t, "http://cfg-host", GuessCurrentHostURL(ctx))
|
|
})
|
|
}
|
|
|
|
func TestMakeAbsoluteURL(t *testing.T) {
|
|
defer test.MockVariableValue(&setting.Protocol, "http")()
|
|
defer test.MockVariableValue(&setting.AppURL, "http://cfg-host/sub/")()
|
|
defer test.MockVariableValue(&setting.AppSubURL, "/sub")()
|
|
|
|
ctx := t.Context()
|
|
assert.Equal(t, "http://cfg-host/sub/", MakeAbsoluteURL(ctx, ""))
|
|
assert.Equal(t, "http://cfg-host/foo", MakeAbsoluteURL(ctx, "foo"))
|
|
assert.Equal(t, "http://cfg-host/foo", MakeAbsoluteURL(ctx, "/foo"))
|
|
assert.Equal(t, "http://other/foo", MakeAbsoluteURL(ctx, "http://other/foo"))
|
|
|
|
ctx = context.WithValue(ctx, RequestContextKey, &http.Request{
|
|
Host: "user-host",
|
|
})
|
|
assert.Equal(t, "http://cfg-host/foo", MakeAbsoluteURL(ctx, "/foo"))
|
|
|
|
ctx = context.WithValue(ctx, RequestContextKey, &http.Request{
|
|
Host: "user-host",
|
|
Header: map[string][]string{
|
|
"X-Forwarded-Host": {"forwarded-host"},
|
|
},
|
|
})
|
|
assert.Equal(t, "http://cfg-host/foo", MakeAbsoluteURL(ctx, "/foo"))
|
|
|
|
ctx = context.WithValue(ctx, RequestContextKey, &http.Request{
|
|
Host: "user-host",
|
|
Header: map[string][]string{
|
|
"X-Forwarded-Host": {"forwarded-host"},
|
|
"X-Forwarded-Proto": {"https"},
|
|
},
|
|
})
|
|
assert.Equal(t, "https://user-host/foo", MakeAbsoluteURL(ctx, "/foo"))
|
|
}
|
|
|
|
func TestIsCurrentGitSiteURL(t *testing.T) {
|
|
defer test.MockVariableValue(&setting.AppURL, "http://localhost:3000/sub/")()
|
|
defer test.MockVariableValue(&setting.AppSubURL, "/sub")()
|
|
ctx := t.Context()
|
|
good := []string{
|
|
"?key=val",
|
|
"/sub",
|
|
"/sub/",
|
|
"/sub/foo",
|
|
"/sub/foo/",
|
|
"http://localhost:3000/sub?key=val",
|
|
"http://localhost:3000/sub/",
|
|
}
|
|
for _, s := range good {
|
|
assert.True(t, IsCurrentGitSiteURL(ctx, s), "good = %q", s)
|
|
}
|
|
bad := []string{
|
|
".",
|
|
"foo",
|
|
"/",
|
|
"//",
|
|
"\\\\",
|
|
"/foo",
|
|
"http://localhost:3000/sub/..",
|
|
"http://localhost:3000/other",
|
|
"http://other/",
|
|
}
|
|
for _, s := range bad {
|
|
assert.False(t, IsCurrentGitSiteURL(ctx, s), "bad = %q", s)
|
|
}
|
|
|
|
setting.AppURL = "http://localhost:3000/"
|
|
setting.AppSubURL = ""
|
|
assert.False(t, IsCurrentGitSiteURL(ctx, "//"))
|
|
assert.False(t, IsCurrentGitSiteURL(ctx, "\\\\"))
|
|
assert.False(t, IsCurrentGitSiteURL(ctx, "http://localhost"))
|
|
assert.True(t, IsCurrentGitSiteURL(ctx, "http://localhost:3000?key=val"))
|
|
|
|
ctx = context.WithValue(ctx, RequestContextKey, &http.Request{
|
|
Host: "user-host",
|
|
Header: map[string][]string{
|
|
"X-Forwarded-Host": {"forwarded-host"},
|
|
"X-Forwarded-Proto": {"https"},
|
|
},
|
|
})
|
|
assert.True(t, IsCurrentGitSiteURL(ctx, "http://localhost:3000"))
|
|
assert.True(t, IsCurrentGitSiteURL(ctx, "https://user-host"))
|
|
assert.False(t, IsCurrentGitSiteURL(ctx, "https://forwarded-host"))
|
|
}
|
|
|
|
func TestParseGitSiteURL(t *testing.T) {
|
|
defer test.MockVariableValue(&setting.AppURL, "http://localhost:3000/sub/")()
|
|
defer test.MockVariableValue(&setting.AppSubURL, "/sub")()
|
|
ctx := t.Context()
|
|
tests := []struct {
|
|
url string
|
|
exp *GitSiteURL
|
|
}{
|
|
{"http://localhost:3000/sub?k=v", &GitSiteURL{RoutePath: ""}},
|
|
{"http://localhost:3000/sub/", &GitSiteURL{RoutePath: ""}},
|
|
{"http://localhost:3000/sub/foo", &GitSiteURL{RoutePath: "/foo"}},
|
|
{"http://localhost:3000/sub/foo/bar", &GitSiteURL{RoutePath: "/foo/bar", OwnerName: "foo", RepoName: "bar"}},
|
|
{"http://localhost:3000/sub/foo/bar/", &GitSiteURL{RoutePath: "/foo/bar", OwnerName: "foo", RepoName: "bar"}},
|
|
{"http://localhost:3000/sub/attachments/bar", &GitSiteURL{RoutePath: "/attachments/bar"}},
|
|
{"http://localhost:3000/other", nil},
|
|
{"http://other/", nil},
|
|
}
|
|
for _, test := range tests {
|
|
su := ParseGitSiteURL(ctx, test.url)
|
|
assert.Equal(t, test.exp, su, "URL = %s", test.url)
|
|
}
|
|
}
|