mirror of
https://github.com/hanzoai/forge.git
synced 2026-10-30 15:00:39 +00:00
zeekayandHanzo Dev
3ee9531d56
Fixtures asserted against try.gitea.io, gitea.io and repositories under upstream's accounts. They now use reserved example hosts and an example owner, the recorded downloader responses were renamed to match, and the RPM and Alpine package fixtures were rebuilt with recomputed digests. The schema dumps the migration test restores are named for the version they capture. Two fixtures were wrong, not merely branded. readme-test carried a special-subdir-.gitea branch while the README lookup and its test both read .hanzo, so that case asserted against a branch that did not exist; the branch now holds .hanzo/README.md. The repository fixtures' delegate hooks still re-exec the pre-rename binary name, and the licenses end-to-end test looked for a module this tree no longer depends on. Co-authored-by: Hanzo Dev <[email protected]>
118 lines
4.2 KiB
Go
118 lines
4.2 KiB
Go
// Copyright 2026 Hanzo AI, Inc. All rights reserved.
|
|
// SPDX-License-Identifier: MIT
|
|
|
|
package migrations
|
|
|
|
import (
|
|
"net"
|
|
"path/filepath"
|
|
"testing"
|
|
|
|
"github.com/hanzoai/git/models/unittest"
|
|
user_model "github.com/hanzoai/git/models/user"
|
|
"github.com/hanzoai/git/modules/setting"
|
|
|
|
"github.com/stretchr/testify/assert"
|
|
)
|
|
|
|
func TestMigrateWhiteBlocklist(t *testing.T) {
|
|
assert.NoError(t, unittest.PrepareTestDatabase())
|
|
|
|
adminUser := unittest.AssertExistsAndLoadBean(t, &user_model.User{Name: "user1"})
|
|
nonAdminUser := unittest.AssertExistsAndLoadBean(t, &user_model.User{Name: "user2"})
|
|
|
|
setting.Migrations.AllowedDomains = "github.com"
|
|
setting.Migrations.AllowLocalNetworks = false
|
|
assert.NoError(t, Init())
|
|
|
|
err := IsMigrateURLAllowed("https://gitlab.com/gitlab/gitlab.git", nonAdminUser)
|
|
assert.Error(t, err)
|
|
|
|
err = IsMigrateURLAllowed("https://github.com/example/example.git", nonAdminUser)
|
|
assert.NoError(t, err)
|
|
|
|
err = IsMigrateURLAllowed("https://gITHUb.com/example/example.git", nonAdminUser)
|
|
assert.NoError(t, err)
|
|
|
|
setting.Migrations.AllowedDomains = ""
|
|
setting.Migrations.BlockedDomains = "github.com"
|
|
assert.NoError(t, Init())
|
|
|
|
err = IsMigrateURLAllowed("https://gitlab.com/gitlab/gitlab.git", nonAdminUser)
|
|
assert.NoError(t, err)
|
|
|
|
err = IsMigrateURLAllowed("https://github.com/example/example.git", nonAdminUser)
|
|
assert.Error(t, err)
|
|
|
|
err = IsMigrateURLAllowed("https://10.0.0.1/example/example.git", nonAdminUser)
|
|
assert.Error(t, err)
|
|
|
|
setting.Migrations.AllowLocalNetworks = true
|
|
assert.NoError(t, Init())
|
|
err = IsMigrateURLAllowed("https://10.0.0.1/example/example.git", nonAdminUser)
|
|
assert.NoError(t, err)
|
|
|
|
old := setting.ImportLocalPaths
|
|
setting.ImportLocalPaths = false
|
|
|
|
err = IsMigrateURLAllowed("/home/foo/bar/goo", adminUser)
|
|
assert.Error(t, err)
|
|
|
|
setting.ImportLocalPaths = true
|
|
abs, err := filepath.Abs(".")
|
|
assert.NoError(t, err)
|
|
|
|
err = IsMigrateURLAllowed(abs, adminUser)
|
|
assert.NoError(t, err)
|
|
|
|
err = IsMigrateURLAllowed(abs, nonAdminUser)
|
|
assert.Error(t, err)
|
|
|
|
nonAdminUser.AllowImportLocal = true
|
|
err = IsMigrateURLAllowed(abs, nonAdminUser)
|
|
assert.NoError(t, err)
|
|
|
|
setting.ImportLocalPaths = old
|
|
}
|
|
|
|
func TestAllowBlockList(t *testing.T) {
|
|
init := func(allow, block string, local bool) {
|
|
setting.Migrations.AllowedDomains = allow
|
|
setting.Migrations.BlockedDomains = block
|
|
setting.Migrations.AllowLocalNetworks = local
|
|
assert.NoError(t, Init())
|
|
}
|
|
|
|
// default, allow all external, block none, no local networks
|
|
init("", "", false)
|
|
assert.NoError(t, checkByAllowBlockList("domain.com", []net.IP{net.ParseIP("1.2.3.4")}))
|
|
assert.Error(t, checkByAllowBlockList("domain.com", []net.IP{net.ParseIP("127.0.0.1")}))
|
|
|
|
// allow all including local networks (it could lead to SSRF in production)
|
|
init("", "", true)
|
|
assert.NoError(t, checkByAllowBlockList("domain.com", []net.IP{net.ParseIP("1.2.3.4")}))
|
|
assert.NoError(t, checkByAllowBlockList("domain.com", []net.IP{net.ParseIP("127.0.0.1")}))
|
|
|
|
// allow wildcard, block some subdomains. every resolved address must still be allowed.
|
|
init("*.domain.com", "blocked.domain.com", false)
|
|
assert.NoError(t, checkByAllowBlockList("sub.domain.com", []net.IP{net.ParseIP("1.2.3.4")}))
|
|
assert.Error(t, checkByAllowBlockList("sub.domain.com", []net.IP{net.ParseIP("127.0.0.1")}))
|
|
assert.Error(t, checkByAllowBlockList("sub.domain.com", []net.IP{net.ParseIP("1.2.3.4"), net.ParseIP("127.0.0.1")}))
|
|
assert.Error(t, checkByAllowBlockList("blocked.domain.com", []net.IP{net.ParseIP("1.2.3.4")}))
|
|
assert.Error(t, checkByAllowBlockList("sub.other.com", []net.IP{net.ParseIP("1.2.3.4")}))
|
|
|
|
// allow wildcard still follows the local network policy for resolved addresses.
|
|
init("*", "", false)
|
|
assert.NoError(t, checkByAllowBlockList("domain.com", []net.IP{net.ParseIP("1.2.3.4")}))
|
|
assert.Error(t, checkByAllowBlockList("domain.com", []net.IP{net.ParseIP("127.0.0.1")}))
|
|
assert.Error(t, checkByAllowBlockList("domain.com", []net.IP{net.ParseIP("1.2.3.4"), net.ParseIP("127.0.0.1")}))
|
|
|
|
// local network can still be blocked
|
|
init("*", "127.0.0.*", false)
|
|
assert.NoError(t, checkByAllowBlockList("domain.com", []net.IP{net.ParseIP("1.2.3.4")}))
|
|
assert.Error(t, checkByAllowBlockList("domain.com", []net.IP{net.ParseIP("127.0.0.1")}))
|
|
|
|
// reset to allow local networks (mock servers use 127.0.0.1)
|
|
init("", "", true)
|
|
}
|