Fix username rendering bug (#2122)
* Fix username rendering bug * XSS integration test * Migration to unescape user full namestokarchuk/v1.17
parent
2c3efd72ce
commit
858324c21a
@ -0,0 +1,37 @@ |
|||||||
|
// Copyright 2017 The Gitea Authors. All rights reserved.
|
||||||
|
// Use of this source code is governed by a MIT-style
|
||||||
|
// license that can be found in the LICENSE file.
|
||||||
|
|
||||||
|
package integrations |
||||||
|
|
||||||
|
import ( |
||||||
|
"net/http" |
||||||
|
"testing" |
||||||
|
|
||||||
|
"code.gitea.io/gitea/models" |
||||||
|
|
||||||
|
"github.com/stretchr/testify/assert" |
||||||
|
) |
||||||
|
|
||||||
|
func TestXSSUserFullName(t *testing.T) { |
||||||
|
prepareTestEnv(t) |
||||||
|
user := models.AssertExistsAndLoadBean(t, &models.User{ID: 2}).(*models.User) |
||||||
|
const fullName = `name & <script class="evil">alert('Oh no!');</script>` |
||||||
|
|
||||||
|
session := loginUser(t, user.Name) |
||||||
|
req := NewRequestWithValues(t, "POST", "/user/settings", map[string]string{ |
||||||
|
"_csrf": GetCSRF(t, session, "/user/settings"), |
||||||
|
"name": user.Name, |
||||||
|
"full_name": fullName, |
||||||
|
"email": user.Email, |
||||||
|
}) |
||||||
|
session.MakeRequest(t, req, http.StatusFound) |
||||||
|
|
||||||
|
req = NewRequestf(t, "GET", "/%s", user.Name) |
||||||
|
resp := session.MakeRequest(t, req, http.StatusOK) |
||||||
|
htmlDoc := NewHTMLParser(t, resp.Body) |
||||||
|
assert.EqualValues(t, 0, htmlDoc.doc.Find("script.evil").Length()) |
||||||
|
assert.EqualValues(t, fullName, |
||||||
|
htmlDoc.doc.Find("div.content").Find(".header.text.center").Text(), |
||||||
|
) |
||||||
|
} |
@ -0,0 +1,32 @@ |
|||||||
|
// Copyright 2017 The Gitea Authors. All rights reserved.
|
||||||
|
// Use of this source code is governed by a MIT-style
|
||||||
|
// license that can be found in the LICENSE file.
|
||||||
|
|
||||||
|
package migrations |
||||||
|
|
||||||
|
import ( |
||||||
|
"html" |
||||||
|
|
||||||
|
"code.gitea.io/gitea/models" |
||||||
|
|
||||||
|
"github.com/go-xorm/xorm" |
||||||
|
) |
||||||
|
|
||||||
|
func unescapeUserFullNames(x *xorm.Engine) (err error) { |
||||||
|
const batchSize = 100 |
||||||
|
for start := 0; ; start += batchSize { |
||||||
|
users := make([]*models.User, 0, batchSize) |
||||||
|
if err := x.Limit(start, batchSize).Find(users); err != nil { |
||||||
|
return err |
||||||
|
} |
||||||
|
if len(users) == 0 { |
||||||
|
return nil |
||||||
|
} |
||||||
|
for _, user := range users { |
||||||
|
user.FullName = html.UnescapeString(user.FullName) |
||||||
|
if _, err := x.Cols("full_name").Update(user); err != nil { |
||||||
|
return err |
||||||
|
} |
||||||
|
} |
||||||
|
} |
||||||
|
} |
Loading…
Reference in new issue