Skip to content

Commit 2aef948

Browse files
zeripathzeripath
authored
Merge branch 'master' into certmagic
2 parents 90dbe86 + 1722299 commit 2aef948

File tree

7 files changed

+130
-17
lines changed

7 files changed

+130
-17
lines changed

‎.drone.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -404,7 +404,7 @@ steps:
404404

405405
- name: update
406406
pull: default
407-
image: alpine:3.12
407+
image: alpine:3.13
408408
commands:
409409
- ./build/update-locales.sh
410410

‎Dockerfile

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11

22
###################################
33
#Build stage
4-
FROM golang:1.15-alpine3.12 AS build-env
4+
FROM golang:1.15-alpine3.13 AS build-env
55

66
ARG GOPROXY
77
ENV GOPROXY ${GOPROXY:-direct}
@@ -22,7 +22,7 @@ WORKDIR ${GOPATH}/src/code.gitea.io/gitea
2222
RUN if [ -n "${GITEA_VERSION}" ]; then git checkout "${GITEA_VERSION}"; fi \
2323
&& make clean-all build
2424

25-
FROM alpine:3.12
25+
FROM alpine:3.13
2626
LABEL maintainer="[email protected]"
2727

2828
EXPOSE 22 3000

‎Dockerfile.rootless

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11

22
###################################
33
#Build stage
4-
FROM golang:1.15-alpine3.12 AS build-env
4+
FROM golang:1.15-alpine3.13 AS build-env
55

66
ARG GOPROXY
77
ENV GOPROXY ${GOPROXY:-direct}
@@ -22,7 +22,7 @@ WORKDIR ${GOPATH}/src/code.gitea.io/gitea
2222
RUN if [ -n "${GITEA_VERSION}" ]; then git checkout "${GITEA_VERSION}"; fi \
2323
&& make clean-all build
2424

25-
FROM alpine:3.12
25+
FROM alpine:3.13
2626
LABEL maintainer="[email protected]"
2727

2828
EXPOSE 2222 3000

‎modules/context/response.go

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
// Copyright 2021 The Gitea Authors. All rights reserved.
2+
// Use of this source code is governed by a MIT-style
3+
// license that can be found in the LICENSE file.
4+
5+
package context
6+
7+
import "net/http"
8+
9+
// ResponseWriter represents a response writer for HTTP
10+
type ResponseWriter interface {
11+
http.ResponseWriter
12+
Flush()
13+
Status() int
14+
}
15+
16+
var (
17+
_ ResponseWriter = &Response{}
18+
)
19+
20+
// Response represents a response
21+
type Response struct {
22+
http.ResponseWriter
23+
status int
24+
}
25+
26+
// Write writes bytes to HTTP endpoint
27+
func (r *Response) Write(bs []byte) (int, error) {
28+
size, err := r.ResponseWriter.Write(bs)
29+
if err != nil {
30+
return 0, err
31+
}
32+
if r.status == 0 {
33+
r.WriteHeader(200)
34+
}
35+
return size, nil
36+
}
37+
38+
// WriteHeader write status code
39+
func (r *Response) WriteHeader(statusCode int) {
40+
r.status = statusCode
41+
r.ResponseWriter.WriteHeader(statusCode)
42+
}
43+
44+
// Flush flush cached data
45+
func (r *Response) Flush() {
46+
if f, ok := r.ResponseWriter.(http.Flusher); ok {
47+
f.Flush()
48+
}
49+
}
50+
51+
// Status returned status code written
52+
func (r *Response) Status() int {
53+
return r.status
54+
}
55+
56+
// NewResponse creates a response
57+
func NewResponse(resp http.ResponseWriter) *Response {
58+
if v, ok := resp.(*Response); ok {
59+
return v
60+
}
61+
return &Response{resp, 0}
62+
}

‎modules/markup/html.go

Lines changed: 28 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -317,19 +317,16 @@ func RenderEmoji(
317317
return ctx.postProcess(rawHTML)
318318
}
319319

320-
var byteBodyTag = []byte("<body>")
321-
var byteBodyTagClosing = []byte("</body>")
322-
323320
func (ctx *postProcessCtx) postProcess(rawHTML []byte) ([]byte, error) {
324321
if ctx.procs == nil {
325322
ctx.procs = defaultProcessors
326323
}
327324

328325
// give a generous extra 50 bytes
329326
res := make([]byte, 0, len(rawHTML)+50)
330-
res = append(res, byteBodyTag...)
327+
res = append(res, "<html><body>"...)
331328
res = append(res, rawHTML...)
332-
res = append(res, byteBodyTagClosing...)
329+
res = append(res, "</body></html>"...)
333330

334331
// parse the HTML
335332
nodes, err := html.ParseFragment(bytes.NewReader(res), nil)
@@ -341,6 +338,31 @@ func (ctx *postProcessCtx) postProcess(rawHTML []byte) ([]byte, error) {
341338
ctx.visitNode(node, true)
342339
}
343340

341+
newNodes := make([]*html.Node, 0, len(nodes))
342+
343+
for _, node := range nodes {
344+
if node.Data == "html" {
345+
node = node.FirstChild
346+
for node != nil && node.Data != "body" {
347+
node = node.NextSibling
348+
}
349+
}
350+
if node == nil {
351+
continue
352+
}
353+
if node.Data == "body" {
354+
child := node.FirstChild
355+
for child != nil {
356+
newNodes = append(newNodes, child)
357+
child = child.NextSibling
358+
}
359+
} else {
360+
newNodes = append(newNodes, node)
361+
}
362+
}
363+
364+
nodes = newNodes
365+
344366
// Create buffer in which the data will be placed again. We know that the
345367
// length will be at least that of res; to spare a few alloc+copy, we
346368
// reuse res, resetting its length to 0.
@@ -353,12 +375,8 @@ func (ctx *postProcessCtx) postProcess(rawHTML []byte) ([]byte, error) {
353375
}
354376
}
355377

356-
// remove initial parts - because Render creates a whole HTML page.
357-
res = buf.Bytes()
358-
res = res[bytes.Index(res, byteBodyTag)+len(byteBodyTag) : bytes.LastIndex(res, byteBodyTagClosing)]
359-
360378
// Everything done successfully, return parsed data.
361-
return res, nil
379+
return buf.Bytes(), nil
362380
}
363381

364382
func (ctx *postProcessCtx) visitNode(node *html.Node, visitText bool) {

‎modules/markup/html_test.go

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -383,3 +383,28 @@ func TestRender_ShortLinks(t *testing.T) {
383383
`<p><a href="https://example.org" rel="nofollow">[[foobar]]</a></p>`,
384384
`<p><a href="https://example.org" rel="nofollow">[[foobar]]</a></p>`)
385385
}
386+
387+
func Test_ParseClusterFuzz(t *testing.T) {
388+
setting.AppURL = AppURL
389+
setting.AppSubURL = AppSubURL
390+
391+
var localMetas = map[string]string{
392+
"user": "go-gitea",
393+
"repo": "gitea",
394+
}
395+
396+
data := "<A><maTH><tr><MN><bodY ÿ><temPlate></template><tH><tr></A><tH><d<bodY "
397+
398+
val, err := PostProcess([]byte(data), "https://example.com", localMetas, false)
399+
400+
assert.NoError(t, err)
401+
assert.NotContains(t, string(val), "<html")
402+
403+
data = "<!DOCTYPE html>\n<A><maTH><tr><MN><bodY ÿ><temPlate></template><tH><tr></A><tH><d<bodY "
404+
405+
val, err = PostProcess([]byte(data), "https://example.com", localMetas, false)
406+
407+
assert.NoError(t, err)
408+
409+
assert.NotContains(t, string(val), "<html")
410+
}

‎routers/routes/chi.go

Lines changed: 10 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,7 @@ import (
1616
"text/template"
1717
"time"
1818

19+
"code.gitea.io/gitea/modules/context"
1920
"code.gitea.io/gitea/modules/httpcache"
2021
"code.gitea.io/gitea/modules/log"
2122
"code.gitea.io/gitea/modules/metrics"
@@ -90,9 +91,11 @@ func LoggerHandler(level log.Level) func(next http.Handler) http.Handler {
9091

9192
next.ServeHTTP(w, req)
9293

93-
ww := middleware.NewWrapResponseWriter(w, req.ProtoMajor)
94+
var status int
95+
if v, ok := w.(context.ResponseWriter); ok {
96+
status = v.Status()
97+
}
9498

95-
status := ww.Status()
9699
_ = log.GetLogger("router").Log(0, level, "Completed %s %s %v %s in %v", log.ColoredMethod(req.Method), req.URL.RequestURI(), log.ColoredStatus(status), log.ColoredStatus(status, http.StatusText(status)), log.ColoredTime(time.Since(start)))
97100
})
98101
}
@@ -183,6 +186,11 @@ var (
183186
// NewChi creates a chi Router
184187
func NewChi() chi.Router {
185188
c := chi.NewRouter()
189+
c.Use(func(next http.Handler) http.Handler {
190+
return http.HandlerFunc(func(resp http.ResponseWriter, req *http.Request) {
191+
next.ServeHTTP(context.NewResponse(resp), req)
192+
})
193+
})
186194
c.Use(middleware.RealIP)
187195
if !setting.DisableRouterLog && setting.RouterLogLevel != log.NONE {
188196
if log.GetLogger("router").GetLevel() <= setting.RouterLogLevel {

0 commit comments

Comments
 (0)