Attachments: Add extension support, allow all types for releases (#12465)
* Attachments: Add extension support, allow all types for releases - Add support for file extensions, matching the `accept` attribute of `<input type="file">` - Add support for type wildcard mime types, e.g. `image/*` - Create repository.release.ALLOWED_TYPES setting (default unrestricted) - Change default for attachment.ALLOWED_TYPES to a list of extensions - Split out POST /attachments into two endpoints for issue/pr and releases to prevent circumvention of allowed types check Fixes: https://github.com/go-gitea/gitea/pull/10172 Fixes: https://github.com/go-gitea/gitea/issues/7266 Fixes: https://github.com/go-gitea/gitea/pull/12460 Ref: https://developer.mozilla.org/en-US/docs/Web/HTML/Element/input/file#Unique_file_type_specifiers * rename function * extract GET routes out of RepoMustNotBeArchived Co-authored-by: Lauris BH <lauris@nix.lv>tokarchuk/v1.17
silverwind
4 years ago
committed by
GitHub
parent
67a5573310
commit
cda44750cb
@ -1,46 +0,0 @@ |
|||||||
// Copyright 2019 The Gitea Authors. All rights reserved.
|
|
||||||
// Use of this source code is governed by a MIT-style
|
|
||||||
// license that can be found in the LICENSE file.
|
|
||||||
|
|
||||||
package upload |
|
||||||
|
|
||||||
import ( |
|
||||||
"fmt" |
|
||||||
"net/http" |
|
||||||
"strings" |
|
||||||
|
|
||||||
"code.gitea.io/gitea/modules/log" |
|
||||||
) |
|
||||||
|
|
||||||
// ErrFileTypeForbidden not allowed file type error
|
|
||||||
type ErrFileTypeForbidden struct { |
|
||||||
Type string |
|
||||||
} |
|
||||||
|
|
||||||
// IsErrFileTypeForbidden checks if an error is a ErrFileTypeForbidden.
|
|
||||||
func IsErrFileTypeForbidden(err error) bool { |
|
||||||
_, ok := err.(ErrFileTypeForbidden) |
|
||||||
return ok |
|
||||||
} |
|
||||||
|
|
||||||
func (err ErrFileTypeForbidden) Error() string { |
|
||||||
return fmt.Sprintf("File type is not allowed: %s", err.Type) |
|
||||||
} |
|
||||||
|
|
||||||
// VerifyAllowedContentType validates a file is allowed to be uploaded.
|
|
||||||
func VerifyAllowedContentType(buf []byte, allowedTypes []string) error { |
|
||||||
fileType := http.DetectContentType(buf) |
|
||||||
|
|
||||||
for _, t := range allowedTypes { |
|
||||||
t := strings.Trim(t, " ") |
|
||||||
|
|
||||||
if t == "*/*" || t == fileType || |
|
||||||
// Allow directives after type, like 'text/plain; charset=utf-8'
|
|
||||||
strings.HasPrefix(fileType, t+";") { |
|
||||||
return nil |
|
||||||
} |
|
||||||
} |
|
||||||
|
|
||||||
log.Info("Attachment with type %s blocked from upload", fileType) |
|
||||||
return ErrFileTypeForbidden{Type: fileType} |
|
||||||
} |
|
||||||
@ -1,47 +0,0 @@ |
|||||||
// Copyright 2019 The Gitea Authors. All rights reserved.
|
|
||||||
// Use of this source code is governed by a MIT-style
|
|
||||||
// license that can be found in the LICENSE file.
|
|
||||||
|
|
||||||
package upload |
|
||||||
|
|
||||||
import ( |
|
||||||
"bytes" |
|
||||||
"compress/gzip" |
|
||||||
"testing" |
|
||||||
|
|
||||||
"github.com/stretchr/testify/assert" |
|
||||||
) |
|
||||||
|
|
||||||
func TestUpload(t *testing.T) { |
|
||||||
testContent := []byte(`This is a plain text file.`) |
|
||||||
var b bytes.Buffer |
|
||||||
w := gzip.NewWriter(&b) |
|
||||||
w.Write(testContent) |
|
||||||
w.Close() |
|
||||||
|
|
||||||
kases := []struct { |
|
||||||
data []byte |
|
||||||
allowedTypes []string |
|
||||||
err error |
|
||||||
}{ |
|
||||||
{ |
|
||||||
data: testContent, |
|
||||||
allowedTypes: []string{"text/plain"}, |
|
||||||
err: nil, |
|
||||||
}, |
|
||||||
{ |
|
||||||
data: testContent, |
|
||||||
allowedTypes: []string{"application/x-gzip"}, |
|
||||||
err: ErrFileTypeForbidden{"text/plain; charset=utf-8"}, |
|
||||||
}, |
|
||||||
{ |
|
||||||
data: b.Bytes(), |
|
||||||
allowedTypes: []string{"application/x-gzip"}, |
|
||||||
err: nil, |
|
||||||
}, |
|
||||||
} |
|
||||||
|
|
||||||
for _, kase := range kases { |
|
||||||
assert.Equal(t, kase.err, VerifyAllowedContentType(kase.data, kase.allowedTypes)) |
|
||||||
} |
|
||||||
} |
|
||||||
@ -0,0 +1,94 @@ |
|||||||
|
// Copyright 2019 The Gitea Authors. All rights reserved.
|
||||||
|
// Use of this source code is governed by a MIT-style
|
||||||
|
// license that can be found in the LICENSE file.
|
||||||
|
|
||||||
|
package upload |
||||||
|
|
||||||
|
import ( |
||||||
|
"net/http" |
||||||
|
"path" |
||||||
|
"regexp" |
||||||
|
"strings" |
||||||
|
|
||||||
|
"code.gitea.io/gitea/modules/context" |
||||||
|
"code.gitea.io/gitea/modules/log" |
||||||
|
"code.gitea.io/gitea/modules/setting" |
||||||
|
) |
||||||
|
|
||||||
|
// ErrFileTypeForbidden not allowed file type error
|
||||||
|
type ErrFileTypeForbidden struct { |
||||||
|
Type string |
||||||
|
} |
||||||
|
|
||||||
|
// IsErrFileTypeForbidden checks if an error is a ErrFileTypeForbidden.
|
||||||
|
func IsErrFileTypeForbidden(err error) bool { |
||||||
|
_, ok := err.(ErrFileTypeForbidden) |
||||||
|
return ok |
||||||
|
} |
||||||
|
|
||||||
|
func (err ErrFileTypeForbidden) Error() string { |
||||||
|
return "This file extension or type is not allowed to be uploaded." |
||||||
|
} |
||||||
|
|
||||||
|
var mimeTypeSuffixRe = regexp.MustCompile(`;.*$`) |
||||||
|
var wildcardTypeRe = regexp.MustCompile(`^[a-z]+/\*$`) |
||||||
|
|
||||||
|
// Verify validates whether a file is allowed to be uploaded.
|
||||||
|
func Verify(buf []byte, fileName string, allowedTypesStr string) error { |
||||||
|
allowedTypesStr = strings.ReplaceAll(allowedTypesStr, "|", ",") // compat for old config format
|
||||||
|
|
||||||
|
allowedTypes := []string{} |
||||||
|
for _, entry := range strings.Split(allowedTypesStr, ",") { |
||||||
|
entry = strings.ToLower(strings.TrimSpace(entry)) |
||||||
|
if entry != "" { |
||||||
|
allowedTypes = append(allowedTypes, entry) |
||||||
|
} |
||||||
|
} |
||||||
|
|
||||||
|
if len(allowedTypes) == 0 { |
||||||
|
return nil // everything is allowed
|
||||||
|
} |
||||||
|
|
||||||
|
fullMimeType := http.DetectContentType(buf) |
||||||
|
mimeType := strings.TrimSpace(mimeTypeSuffixRe.ReplaceAllString(fullMimeType, "")) |
||||||
|
extension := strings.ToLower(path.Ext(fileName)) |
||||||
|
|
||||||
|
// https://developer.mozilla.org/en-US/docs/Web/HTML/Element/input/file#Unique_file_type_specifiers
|
||||||
|
for _, allowEntry := range allowedTypes { |
||||||
|
if allowEntry == "*/*" { |
||||||
|
return nil // everything allowed
|
||||||
|
} else if strings.HasPrefix(allowEntry, ".") && allowEntry == extension { |
||||||
|
return nil // extension is allowed
|
||||||
|
} else if mimeType == allowEntry { |
||||||
|
return nil // mime type is allowed
|
||||||
|
} else if wildcardTypeRe.MatchString(allowEntry) && strings.HasPrefix(mimeType, allowEntry[:len(allowEntry)-1]) { |
||||||
|
return nil // wildcard match, e.g. image/*
|
||||||
|
} |
||||||
|
} |
||||||
|
|
||||||
|
log.Info("Attachment with type %s blocked from upload", fullMimeType) |
||||||
|
return ErrFileTypeForbidden{Type: fullMimeType} |
||||||
|
} |
||||||
|
|
||||||
|
// AddUploadContext renders template values for dropzone
|
||||||
|
func AddUploadContext(ctx *context.Context, uploadType string) { |
||||||
|
if uploadType == "release" { |
||||||
|
ctx.Data["UploadUrl"] = ctx.Repo.RepoLink + "/releases/attachments" |
||||||
|
ctx.Data["UploadRemoveUrl"] = ctx.Repo.RepoLink + "/releases/attachments/remove" |
||||||
|
ctx.Data["UploadAccepts"] = strings.Replace(setting.Repository.Release.AllowedTypes, "|", ",", -1) |
||||||
|
ctx.Data["UploadMaxFiles"] = setting.Attachment.MaxFiles |
||||||
|
ctx.Data["UploadMaxSize"] = setting.Attachment.MaxSize |
||||||
|
} else if uploadType == "comment" { |
||||||
|
ctx.Data["UploadUrl"] = ctx.Repo.RepoLink + "/issues/attachments" |
||||||
|
ctx.Data["UploadRemoveUrl"] = ctx.Repo.RepoLink + "/issues/attachments/remove" |
||||||
|
ctx.Data["UploadAccepts"] = strings.Replace(setting.Attachment.AllowedTypes, "|", ",", -1) |
||||||
|
ctx.Data["UploadMaxFiles"] = setting.Attachment.MaxFiles |
||||||
|
ctx.Data["UploadMaxSize"] = setting.Attachment.MaxSize |
||||||
|
} else if uploadType == "repo" { |
||||||
|
ctx.Data["UploadUrl"] = ctx.Repo.RepoLink + "/upload-file" |
||||||
|
ctx.Data["UploadRemoveUrl"] = ctx.Repo.RepoLink + "/upload-remove" |
||||||
|
ctx.Data["UploadAccepts"] = strings.Replace(setting.Repository.Upload.AllowedTypes, "|", ",", -1) |
||||||
|
ctx.Data["UploadMaxFiles"] = setting.Repository.Upload.MaxFiles |
||||||
|
ctx.Data["UploadMaxSize"] = setting.Repository.Upload.FileMaxSize |
||||||
|
} |
||||||
|
} |
||||||
@ -0,0 +1,195 @@ |
|||||||
|
// Copyright 2019 The Gitea Authors. All rights reserved.
|
||||||
|
// Use of this source code is governed by a MIT-style
|
||||||
|
// license that can be found in the LICENSE file.
|
||||||
|
|
||||||
|
package upload |
||||||
|
|
||||||
|
import ( |
||||||
|
"bytes" |
||||||
|
"compress/gzip" |
||||||
|
"testing" |
||||||
|
|
||||||
|
"github.com/stretchr/testify/assert" |
||||||
|
) |
||||||
|
|
||||||
|
func TestUpload(t *testing.T) { |
||||||
|
testContent := []byte(`This is a plain text file.`) |
||||||
|
var b bytes.Buffer |
||||||
|
w := gzip.NewWriter(&b) |
||||||
|
w.Write(testContent) |
||||||
|
w.Close() |
||||||
|
|
||||||
|
kases := []struct { |
||||||
|
data []byte |
||||||
|
fileName string |
||||||
|
allowedTypes string |
||||||
|
err error |
||||||
|
}{ |
||||||
|
{ |
||||||
|
data: testContent, |
||||||
|
fileName: "test.txt", |
||||||
|
allowedTypes: "", |
||||||
|
err: nil, |
||||||
|
}, |
||||||
|
{ |
||||||
|
data: testContent, |
||||||
|
fileName: "dir/test.txt", |
||||||
|
allowedTypes: "", |
||||||
|
err: nil, |
||||||
|
}, |
||||||
|
{ |
||||||
|
data: testContent, |
||||||
|
fileName: "../../../test.txt", |
||||||
|
allowedTypes: "", |
||||||
|
err: nil, |
||||||
|
}, |
||||||
|
{ |
||||||
|
data: testContent, |
||||||
|
fileName: "test.txt", |
||||||
|
allowedTypes: "", |
||||||
|
err: nil, |
||||||
|
}, |
||||||
|
{ |
||||||
|
data: testContent, |
||||||
|
fileName: "test.txt", |
||||||
|
allowedTypes: ",", |
||||||
|
err: nil, |
||||||
|
}, |
||||||
|
{ |
||||||
|
data: testContent, |
||||||
|
fileName: "test.txt", |
||||||
|
allowedTypes: "|", |
||||||
|
err: nil, |
||||||
|
}, |
||||||
|
{ |
||||||
|
data: testContent, |
||||||
|
fileName: "test.txt", |
||||||
|
allowedTypes: "*/*", |
||||||
|
err: nil, |
||||||
|
}, |
||||||
|
{ |
||||||
|
data: testContent, |
||||||
|
fileName: "test.txt", |
||||||
|
allowedTypes: "*/*,", |
||||||
|
err: nil, |
||||||
|
}, |
||||||
|
{ |
||||||
|
data: testContent, |
||||||
|
fileName: "test.txt", |
||||||
|
allowedTypes: "*/*|", |
||||||
|
err: nil, |
||||||
|
}, |
||||||
|
{ |
||||||
|
data: testContent, |
||||||
|
fileName: "test.txt", |
||||||
|
allowedTypes: "text/plain", |
||||||
|
err: nil, |
||||||
|
}, |
||||||
|
{ |
||||||
|
data: testContent, |
||||||
|
fileName: "dir/test.txt", |
||||||
|
allowedTypes: "text/plain", |
||||||
|
err: nil, |
||||||
|
}, |
||||||
|
{ |
||||||
|
data: testContent, |
||||||
|
fileName: "/dir.txt/test.js", |
||||||
|
allowedTypes: ".js", |
||||||
|
err: nil, |
||||||
|
}, |
||||||
|
{ |
||||||
|
data: testContent, |
||||||
|
fileName: "test.txt", |
||||||
|
allowedTypes: " text/plain ", |
||||||
|
err: nil, |
||||||
|
}, |
||||||
|
{ |
||||||
|
data: testContent, |
||||||
|
fileName: "test.txt", |
||||||
|
allowedTypes: ".txt", |
||||||
|
err: nil, |
||||||
|
}, |
||||||
|
{ |
||||||
|
data: testContent, |
||||||
|
fileName: "test.txt", |
||||||
|
allowedTypes: " .txt,.js", |
||||||
|
err: nil, |
||||||
|
}, |
||||||
|
{ |
||||||
|
data: testContent, |
||||||
|
fileName: "test.txt", |
||||||
|
allowedTypes: " .txt|.js", |
||||||
|
err: nil, |
||||||
|
}, |
||||||
|
{ |
||||||
|
data: testContent, |
||||||
|
fileName: "../../test.txt", |
||||||
|
allowedTypes: " .txt|.js", |
||||||
|
err: nil, |
||||||
|
}, |
||||||
|
{ |
||||||
|
data: testContent, |
||||||
|
fileName: "test.txt", |
||||||
|
allowedTypes: " .txt ,.js ", |
||||||
|
err: nil, |
||||||
|
}, |
||||||
|
{ |
||||||
|
data: testContent, |
||||||
|
fileName: "test.txt", |
||||||
|
allowedTypes: "text/plain, .txt", |
||||||
|
err: nil, |
||||||
|
}, |
||||||
|
{ |
||||||
|
data: testContent, |
||||||
|
fileName: "test.txt", |
||||||
|
allowedTypes: "text/*", |
||||||
|
err: nil, |
||||||
|
}, |
||||||
|
{ |
||||||
|
data: testContent, |
||||||
|
fileName: "test.txt", |
||||||
|
allowedTypes: "text/*,.js", |
||||||
|
err: nil, |
||||||
|
}, |
||||||
|
{ |
||||||
|
data: testContent, |
||||||
|
fileName: "test.txt", |
||||||
|
allowedTypes: "text/**", |
||||||
|
err: ErrFileTypeForbidden{"text/plain; charset=utf-8"}, |
||||||
|
}, |
||||||
|
{ |
||||||
|
data: testContent, |
||||||
|
fileName: "test.txt", |
||||||
|
allowedTypes: "application/x-gzip", |
||||||
|
err: ErrFileTypeForbidden{"text/plain; charset=utf-8"}, |
||||||
|
}, |
||||||
|
{ |
||||||
|
data: testContent, |
||||||
|
fileName: "test.txt", |
||||||
|
allowedTypes: ".zip", |
||||||
|
err: ErrFileTypeForbidden{"text/plain; charset=utf-8"}, |
||||||
|
}, |
||||||
|
{ |
||||||
|
data: testContent, |
||||||
|
fileName: "test.txt", |
||||||
|
allowedTypes: ".zip,.txtx", |
||||||
|
err: ErrFileTypeForbidden{"text/plain; charset=utf-8"}, |
||||||
|
}, |
||||||
|
{ |
||||||
|
data: testContent, |
||||||
|
fileName: "test.txt", |
||||||
|
allowedTypes: ".zip|.txtx", |
||||||
|
err: ErrFileTypeForbidden{"text/plain; charset=utf-8"}, |
||||||
|
}, |
||||||
|
{ |
||||||
|
data: b.Bytes(), |
||||||
|
fileName: "test.txt", |
||||||
|
allowedTypes: "application/x-gzip", |
||||||
|
err: nil, |
||||||
|
}, |
||||||
|
} |
||||||
|
|
||||||
|
for _, kase := range kases { |
||||||
|
assert.Equal(t, kase.err, Verify(kase.data, kase.fileName, kase.allowedTypes)) |
||||||
|
} |
||||||
|
} |
||||||
@ -0,0 +1,13 @@ |
|||||||
|
<div |
||||||
|
class="ui dropzone" |
||||||
|
id="dropzone" |
||||||
|
data-upload-url="{{.UploadUrl}}" |
||||||
|
data-remove-url="{{.UploadRemoveUrl}}" |
||||||
|
data-accepts="{{.UploadAccepts}}" |
||||||
|
data-max-file="{{.UploadMaxFiles}}" |
||||||
|
data-max-size="{{.UploadMaxSize}}" |
||||||
|
data-default-message="{{.i18n.Tr "dropzone.default_message"}}" |
||||||
|
data-invalid-input-type="{{.i18n.Tr "dropzone.invalid_input_type"}}" |
||||||
|
data-file-too-big="{{.i18n.Tr "dropzone.file_too_big"}}" |
||||||
|
data-remove-file="{{.i18n.Tr "dropzone.remove_file"}}" |
||||||
|
></div> |
||||||
Loading…
Reference in new issue