|
| 1 | +// Copyright 2017 The Gitea Authors. All rights reserved. |
| 2 | +// Use of this source code is governed by a MIT-style |
| 3 | +// license that can be found in the LICENSE file. |
| 4 | + |
| 5 | +package validation |
| 6 | + |
| 7 | +import ( |
| 8 | + "fmt" |
| 9 | + "net/url" |
| 10 | + "regexp" |
| 11 | + "strings" |
| 12 | + |
| 13 | + "github.com/go-macaron/binding" |
| 14 | +) |
| 15 | + |
| 16 | +const ( |
| 17 | + // ErrGitRefName is git reference name error |
| 18 | + ErrGitRefName = "GitRefNameError" |
| 19 | +) |
| 20 | + |
| 21 | +var ( |
| 22 | + // GitRefNamePattern is regular expression wirh unallowed characters in git reference name |
| 23 | + GitRefNamePattern = regexp.MustCompile("[^\\d\\w-_\\./]") |
| 24 | +) |
| 25 | + |
| 26 | +// AddBindingRules adds additional binding rules |
| 27 | +func AddBindingRules() { |
| 28 | + addGitRefNameBindingRule() |
| 29 | + addValidURLBindingRule() |
| 30 | +} |
| 31 | + |
| 32 | +func addGitRefNameBindingRule() { |
| 33 | + // Git refname validation rule |
| 34 | + binding.AddRule(&binding.Rule{ |
| 35 | + IsMatch: func(rule string) bool { |
| 36 | + return strings.HasPrefix(rule, "GitRefName") |
| 37 | + }, |
| 38 | + IsValid: func(errs binding.Errors, name string, val interface{}) (bool, binding.Errors) { |
| 39 | + str := fmt.Sprintf("%v", val) |
| 40 | + |
| 41 | + if GitRefNamePattern.MatchString(str) { |
| 42 | + errs.Add([]string{name}, ErrGitRefName, "GitRefName") |
| 43 | + return false, errs |
| 44 | + } |
| 45 | + // Additional rules as described at https://www.kernel.org/pub/software/scm/git/docs/git-check-ref-format.html |
| 46 | + if strings.HasPrefix(str, "/") || strings.HasSuffix(str, "/") || |
| 47 | + strings.HasPrefix(str, ".") || strings.HasSuffix(str, ".") || |
| 48 | + strings.HasSuffix(str, ".lock") || |
| 49 | + strings.Contains(str, "..") || strings.Contains(str, "//") { |
| 50 | + errs.Add([]string{name}, ErrGitRefName, "GitRefName") |
| 51 | + return false, errs |
| 52 | + } |
| 53 | + |
| 54 | + return true, errs |
| 55 | + }, |
| 56 | + }) |
| 57 | +} |
| 58 | + |
| 59 | +func addValidURLBindingRule() { |
| 60 | + // URL validation rule |
| 61 | + binding.AddRule(&binding.Rule{ |
| 62 | + IsMatch: func(rule string) bool { |
| 63 | + return strings.HasPrefix(rule, "ValidUrl") |
| 64 | + }, |
| 65 | + IsValid: func(errs binding.Errors, name string, val interface{}) (bool, binding.Errors) { |
| 66 | + str := fmt.Sprintf("%v", val) |
| 67 | + if len(str) != 0 { |
| 68 | + if u, err := url.ParseRequestURI(str); err != nil || |
| 69 | + (u.Scheme != "http" && u.Scheme != "https") || |
| 70 | + !validPort(portOnly(u.Host)) { |
| 71 | + errs.Add([]string{name}, binding.ERR_URL, "Url") |
| 72 | + return false, errs |
| 73 | + } |
| 74 | + } |
| 75 | + |
| 76 | + return true, errs |
| 77 | + }, |
| 78 | + }) |
| 79 | +} |
| 80 | + |
| 81 | +func portOnly(hostport string) string { |
| 82 | + colon := strings.IndexByte(hostport, ':') |
| 83 | + if colon == -1 { |
| 84 | + return "" |
| 85 | + } |
| 86 | + if i := strings.Index(hostport, "]:"); i != -1 { |
| 87 | + return hostport[i+len("]:"):] |
| 88 | + } |
| 89 | + if strings.Contains(hostport, "]") { |
| 90 | + return "" |
| 91 | + } |
| 92 | + return hostport[colon+len(":"):] |
| 93 | +} |
| 94 | + |
| 95 | +func validPort(p string) bool { |
| 96 | + for _, r := range []byte(p) { |
| 97 | + if r < '0' || r > '9' { |
| 98 | + return false |
| 99 | + } |
| 100 | + } |
| 101 | + return true |
| 102 | +} |
0 commit comments