aboutsummaryrefslogtreecommitdiff
path: root/modules
diff options
context:
space:
mode:
authorLunny Xiao2023-03-08 20:17:39 +0800
committerGitHub2023-03-08 20:17:39 +0800
commitb116418f05b822481bba3613873eef876da73814 (patch)
tree65d1d88d940c26029e7ef920c4dd30761763ce46 /modules
parent090e75392385041b3abb30d02564962a3ff687f6 (diff)
Use CleanPath instead of path.Clean (#23371)
As title.
Diffstat (limited to 'modules')
-rw-r--r--modules/options/base.go10
-rw-r--r--modules/public/public.go4
-rw-r--r--modules/storage/local.go3
-rw-r--r--modules/storage/minio.go3
-rw-r--r--modules/util/path.go8
-rw-r--r--modules/util/path_test.go12
6 files changed, 30 insertions, 10 deletions
diff --git a/modules/options/base.go b/modules/options/base.go
index 3c140f643..e83e8df5d 100644
--- a/modules/options/base.go
+++ b/modules/options/base.go
@@ -16,27 +16,27 @@ import (
// Locale reads the content of a specific locale from static/bindata or custom path.
func Locale(name string) ([]byte, error) {
- return fileFromDir(path.Join("locale", path.Clean("/"+name)))
+ return fileFromDir(path.Join("locale", util.CleanPath(name)))
}
// Readme reads the content of a specific readme from static/bindata or custom path.
func Readme(name string) ([]byte, error) {
- return fileFromDir(path.Join("readme", path.Clean("/"+name)))
+ return fileFromDir(path.Join("readme", util.CleanPath(name)))
}
// Gitignore reads the content of a gitignore locale from static/bindata or custom path.
func Gitignore(name string) ([]byte, error) {
- return fileFromDir(path.Join("gitignore", path.Clean("/"+name)))
+ return fileFromDir(path.Join("gitignore", util.CleanPath(name)))
}
// License reads the content of a specific license from static/bindata or custom path.
func License(name string) ([]byte, error) {
- return fileFromDir(path.Join("license", path.Clean("/"+name)))
+ return fileFromDir(path.Join("license", util.CleanPath(name)))
}
// Labels reads the content of a specific labels from static/bindata or custom path.
func Labels(name string) ([]byte, error) {
- return fileFromDir(path.Join("label", path.Clean("/"+name)))
+ return fileFromDir(path.Join("label", util.CleanPath(name)))
}
// WalkLocales reads the content of a specific locale
diff --git a/modules/public/public.go b/modules/public/public.go
index 42026f9b1..e1d60d89e 100644
--- a/modules/public/public.go
+++ b/modules/public/public.go
@@ -6,7 +6,6 @@ package public
import (
"net/http"
"os"
- "path"
"path/filepath"
"strings"
@@ -14,6 +13,7 @@ import (
"code.gitea.io/gitea/modules/httpcache"
"code.gitea.io/gitea/modules/log"
"code.gitea.io/gitea/modules/setting"
+ "code.gitea.io/gitea/modules/util"
)
// Options represents the available options to configure the handler.
@@ -103,7 +103,7 @@ func setWellKnownContentType(w http.ResponseWriter, file string) {
func (opts *Options) handle(w http.ResponseWriter, req *http.Request, fs http.FileSystem, file string) bool {
// use clean to keep the file is a valid path with no . or ..
- f, err := fs.Open(path.Clean(file))
+ f, err := fs.Open(util.CleanPath(file))
if err != nil {
if os.IsNotExist(err) {
return false
diff --git a/modules/storage/local.go b/modules/storage/local.go
index a6a9d54a8..05bf1fb28 100644
--- a/modules/storage/local.go
+++ b/modules/storage/local.go
@@ -8,7 +8,6 @@ import (
"io"
"net/url"
"os"
- "path"
"path/filepath"
"strings"
@@ -59,7 +58,7 @@ func NewLocalStorage(ctx context.Context, cfg interface{}) (ObjectStorage, error
}
func (l *LocalStorage) buildLocalPath(p string) string {
- return filepath.Join(l.dir, path.Clean("/" + strings.ReplaceAll(p, "\\", "/"))[1:])
+ return filepath.Join(l.dir, util.CleanPath(strings.ReplaceAll(p, "\\", "/")))
}
// Open a file
diff --git a/modules/storage/minio.go b/modules/storage/minio.go
index c427d8d7e..24da14b63 100644
--- a/modules/storage/minio.go
+++ b/modules/storage/minio.go
@@ -15,6 +15,7 @@ import (
"time"
"code.gitea.io/gitea/modules/log"
+ "code.gitea.io/gitea/modules/util"
"github.com/minio/minio-go/v7"
"github.com/minio/minio-go/v7/pkg/credentials"
@@ -120,7 +121,7 @@ func NewMinioStorage(ctx context.Context, cfg interface{}) (ObjectStorage, error
}
func (m *MinioStorage) buildMinioPath(p string) string {
- return strings.TrimPrefix(path.Join(m.basePath, path.Clean("/" + strings.ReplaceAll(p, "\\", "/"))[1:]), "/")
+ return strings.TrimPrefix(path.Join(m.basePath, util.CleanPath(strings.ReplaceAll(p, "\\", "/"))), "/")
}
// Open open a file
diff --git a/modules/util/path.go b/modules/util/path.go
index 74acb7a85..5aa9e15f5 100644
--- a/modules/util/path.go
+++ b/modules/util/path.go
@@ -14,6 +14,14 @@ import (
"strings"
)
+// CleanPath ensure to clean the path
+func CleanPath(p string) string {
+ if strings.HasPrefix(p, "/") {
+ return path.Clean(p)
+ }
+ return path.Clean("/" + p)[1:]
+}
+
// EnsureAbsolutePath ensure that a path is absolute, making it
// relative to absoluteBase if necessary
func EnsureAbsolutePath(path, absoluteBase string) string {
diff --git a/modules/util/path_test.go b/modules/util/path_test.go
index 93f4f67cf..2f020f924 100644
--- a/modules/util/path_test.go
+++ b/modules/util/path_test.go
@@ -136,3 +136,15 @@ func TestMisc_IsReadmeFileName(t *testing.T) {
assert.Equal(t, testCase.idx, idx)
}
}
+
+func TestCleanPath(t *testing.T) {
+ cases := map[string]string{
+ "../../test": "test",
+ "/test": "/test",
+ "/../test": "/test",
+ }
+
+ for k, v := range cases {
+ assert.Equal(t, v, CleanPath(k))
+ }
+}