gitea

History

zeripath bbffcc3aec Multiple Escaping Improvements (#17551 ) There are multiple places where Gitea does not properly escape URLs that it is building and there are multiple places where it builds urls when there is already a simpler function available to use this. This is an extensive PR attempting to fix these issues. 1. The first commit in this PR looks through all href, src and links in the Gitea codebase and has attempted to catch all the places where there is potentially incomplete escaping. 2. Whilst doing this we will prefer to use functions that create URLs over recreating them by hand. 3. All uses of strings should be directly escaped - even if they are not currently expected to contain escaping characters. The main benefit to doing this will be that we can consider relaxing the constraints on user names and reponames in future. 4. The next commit looks at escaping in the wiki and re-considers the urls that are used there. Using the improved escaping here wiki files containing '/'. (This implementation will currently still place all of the wiki files the root directory of the repo but this would not be difficult to change.) 5. The title generation in feeds is now properly escaped. 6. EscapePound is no longer needed - urls should be PathEscaped / QueryEscaped as necessary but then re-escaped with Escape when creating html with locales Signed-off-by: Andrew Thornton <art27@cantab.net> Signed-off-by: Andrew Thornton <art27@cantab.net>		3 years ago
..
appstate	Sync gitea app path for git hooks and authorized keys when starting (#17335 )	3 years ago
avatars	Multiple Escaping Improvements (#17551 )	3 years ago
db	Decouple unit test, remove intermediate `unittestbridge` package (#17662 )	3 years ago
fixtures	Allow U2F 2FA without TOTP (#11573 )	3 years ago
issues	Decouple unit test code from business code (#17623 )	3 years ago
login	Decouple unit test, remove intermediate `unittestbridge` package (#17662 )	3 years ago
migrations	Fix offBy1 errors (#17606 )	3 years ago
unit	Move unit into models/unit/ (#17576 )	3 years ago
unittest	Decouple unit test, remove intermediate `unittestbridge` package (#17662 )	3 years ago
user	Decouple unit test code from business code (#17623 )	3 years ago
webhook	Decouple unit test, remove intermediate `unittestbridge` package (#17662 )	3 years ago
access.go	Nicely handle missing user in collaborations (#17049 )	3 years ago
access_test.go	Decouple unit test, remove intermediate `unittestbridge` package (#17662 )	3 years ago
action.go	Multiple Escaping Improvements (#17551 )	3 years ago
action_list.go	DBContext is just a Context (#17100 )	3 years ago
action_test.go	Decouple unit test, remove intermediate `unittestbridge` package (#17662 )	3 years ago
admin.go	Fix problem when database ID is not incremented as expected (#17229 )	3 years ago
admin_test.go	Decouple unit test, remove intermediate `unittestbridge` package (#17662 )	3 years ago
attachment.go	Multiple Escaping Improvements (#17551 )	3 years ago
attachment_test.go	Decouple unit test, remove intermediate `unittestbridge` package (#17662 )	3 years ago
branches.go	Move unit into models/unit/ (#17576 )	3 years ago
branches_test.go	Decouple unit test, remove intermediate `unittestbridge` package (#17662 )	3 years ago
commit.go	Replace `list.List` with slices (#16311 )	3 years ago
commit_status.go	Multiple Escaping Improvements (#17551 )	3 years ago
commit_status_test.go	Decouple unit test, remove intermediate `unittestbridge` package (#17662 )	3 years ago
consistency.go	Decouple unit test, remove intermediate `unittestbridge` package (#17662 )	3 years ago
consistency_test.go	Decouple unit test code from business code (#17623 )	3 years ago
engine_test.go	Decouple unit test code from business code (#17623 )	3 years ago
error.go	Move EmailAddress & UserRedirect into models/user/ (#17607 )	3 years ago
external_login_user.go	Move login related structs and functions to models/login (#17093 )	3 years ago
fixture_generation.go	DBContext is just a Context (#17100 )	3 years ago
fixture_test.go	Decouple unit test code from business code (#17623 )	3 years ago
gpg_key.go	Move EmailAddress & UserRedirect into models/user/ (#17607 )	3 years ago
gpg_key_add.go	Handle duplicate keys on GPG key ring (#17242 )	3 years ago
gpg_key_commit_verification.go	Move EmailAddress & UserRedirect into models/user/ (#17607 )	3 years ago
gpg_key_common.go	Add option to provide signature for a token to verify key ownership (#14054 )	3 years ago
gpg_key_import.go	DBContext is just a Context (#17100 )	3 years ago
gpg_key_test.go	Decouple unit test, remove intermediate `unittestbridge` package (#17662 )	3 years ago
gpg_key_verify.go	DBContext is just a Context (#17100 )	3 years ago
helper.go	Create doctor command to fix repo_units broken by dumps from 1.14.3-1.14.6 (#17136 )	3 years ago
helper_directory.go	refactor: move from io/ioutil to io and os package (#17109 )	3 years ago
helper_environment.go	chore(models): rewrite code format. (#14754 )	4 years ago
issue.go	Multiple Escaping Improvements (#17551 )	3 years ago
issue_assignees.go	DBContext is just a Context (#17100 )	3 years ago
issue_assignees_test.go	Decouple unit test, remove intermediate `unittestbridge` package (#17662 )	3 years ago
issue_comment.go	Refactor commentTags functionality (#17558 )	3 years ago
issue_comment_list.go	DBContext is just a Context (#17100 )	3 years ago
issue_comment_test.go	Decouple unit test, remove intermediate `unittestbridge` package (#17662 )	3 years ago
issue_dependency.go	Move unit into models/unit/ (#17576 )	3 years ago
issue_dependency_test.go	Decouple unit test, remove intermediate `unittestbridge` package (#17662 )	3 years ago
issue_label.go	Move login related structs and functions to models/login (#17093 )	3 years ago
issue_label_test.go	Decouple unit test, remove intermediate `unittestbridge` package (#17662 )	3 years ago
issue_list.go	DBContext is just a Context (#17100 )	3 years ago
issue_list_test.go	Decouple unit test, remove intermediate `unittestbridge` package (#17662 )	3 years ago
issue_lock.go	DBContext is just a Context (#17100 )	3 years ago
issue_milestone.go	Move login related structs and functions to models/login (#17093 )	3 years ago
issue_milestone_test.go	Decouple unit test, remove intermediate `unittestbridge` package (#17662 )	3 years ago
issue_reaction.go	Added GetUserByIDCtx. (#17602 )	3 years ago
issue_reaction_test.go	Decouple unit test, remove intermediate `unittestbridge` package (#17662 )	3 years ago
issue_stopwatch.go	Move login related structs and functions to models/login (#17093 )	3 years ago
issue_stopwatch_test.go	Decouple unit test, remove intermediate `unittestbridge` package (#17662 )	3 years ago
issue_test.go	Decouple unit test, remove intermediate `unittestbridge` package (#17662 )	3 years ago
issue_tracked_time.go	Move login related structs and functions to models/login (#17093 )	3 years ago
issue_tracked_time_test.go	Decouple unit test, remove intermediate `unittestbridge` package (#17662 )	3 years ago
issue_user.go	DBContext is just a Context (#17100 )	3 years ago
issue_user_test.go	Decouple unit test, remove intermediate `unittestbridge` package (#17662 )	3 years ago
issue_watch.go	Move login related structs and functions to models/login (#17093 )	3 years ago
issue_watch_test.go	Decouple unit test, remove intermediate `unittestbridge` package (#17662 )	3 years ago
issue_xref.go	DBContext is just a Context (#17100 )	3 years ago
issue_xref_test.go	Decouple unit test, remove intermediate `unittestbridge` package (#17662 )	3 years ago
lfs.go	DBContext is just a Context (#17100 )	3 years ago
lfs_lock.go	Move unit into models/unit/ (#17576 )	3 years ago
main_test.go	Decouple unit test, remove intermediate `unittestbridge` package (#17662 )	3 years ago
migrate.go	DBContext is just a Context (#17100 )	3 years ago
notification.go	Multiple Escaping Improvements (#17551 )	3 years ago
notification_test.go	Decouple unit test, remove intermediate `unittestbridge` package (#17662 )	3 years ago
org.go	Move EmailAddress & UserRedirect into models/user/ (#17607 )	3 years ago
org_team.go	Move unit into models/unit/ (#17576 )	3 years ago
org_team_test.go	Decouple unit test, remove intermediate `unittestbridge` package (#17662 )	3 years ago
org_test.go	Decouple unit test, remove intermediate `unittestbridge` package (#17662 )	3 years ago
project.go	DBContext is just a Context (#17100 )	3 years ago
project_board.go	Kanban colored boards (#16647 )	3 years ago
project_issue.go	DBContext is just a Context (#17100 )	3 years ago
project_test.go	Decouple unit test code from business code (#17623 )	3 years ago
protected_tag.go	DBContext is just a Context (#17100 )	3 years ago
protected_tag_test.go	Decouple unit test code from business code (#17623 )	3 years ago
pull.go	Move unit into models/unit/ (#17576 )	3 years ago
pull_list.go	Move login related structs and functions to models/login (#17093 )	3 years ago
pull_sign.go	Move twofactor to models/login (#17143 )	3 years ago
pull_test.go	Decouple unit test, remove intermediate `unittestbridge` package (#17662 )	3 years ago
release.go	Multiple Escaping Improvements (#17551 )	3 years ago
repo.go	Multiple Escaping Improvements (#17551 )	3 years ago
repo_activity.go	DBContext is just a Context (#17100 )	3 years ago
repo_archiver.go	DBContext is just a Context (#17100 )	3 years ago
repo_avatar.go	Multiple Escaping Improvements (#17551 )	3 years ago
repo_branch.go	Move newbranch to standalone package (#9627 )	5 years ago
repo_collaboration.go	Move unit into models/unit/ (#17576 )	3 years ago
repo_collaboration_test.go	Decouple unit test, remove intermediate `unittestbridge` package (#17662 )	3 years ago
repo_generate.go	Move webhook into models/webhook/ (#17579 )	3 years ago
repo_generate_test.go	Fixed assert statements. (#16089 )	4 years ago
repo_indexer.go	DBContext is just a Context (#17100 )	3 years ago
repo_issue.go	Move unit into models/unit/ (#17576 )	3 years ago
repo_language_stats.go	DBContext is just a Context (#17100 )	3 years ago
repo_list.go	Move login related structs and functions to models/login (#17093 )	3 years ago
repo_list_test.go	Decouple unit test, remove intermediate `unittestbridge` package (#17662 )	3 years ago
repo_mirror.go	DBContext is just a Context (#17100 )	3 years ago
repo_permission.go	Move unit into models/unit/ (#17576 )	3 years ago
repo_permission_test.go	Decouple unit test, remove intermediate `unittestbridge` package (#17662 )	3 years ago
repo_pushmirror.go	DBContext is just a Context (#17100 )	3 years ago
repo_pushmirror_test.go	Decouple unit test code from business code (#17623 )	3 years ago
repo_redirect.go	DBContext is just a Context (#17100 )	3 years ago
repo_redirect_test.go	Decouple unit test, remove intermediate `unittestbridge` package (#17662 )	3 years ago
repo_sign.go	Move twofactor to models/login (#17143 )	3 years ago
repo_test.go	Decouple unit test, remove intermediate `unittestbridge` package (#17662 )	3 years ago
repo_transfer.go	Nicely handle missing user in collaborations (#17049 )	3 years ago
repo_transfer_test.go	Decouple unit test, remove intermediate `unittestbridge` package (#17662 )	3 years ago
repo_unit.go	Move unit into models/unit/ (#17576 )	3 years ago
repo_watch.go	Move unit into models/unit/ (#17576 )	3 years ago
repo_watch_test.go	Decouple unit test, remove intermediate `unittestbridge` package (#17662 )	3 years ago
review.go	Move unit into models/unit/ (#17576 )	3 years ago
review_test.go	Decouple unit test, remove intermediate `unittestbridge` package (#17662 )	3 years ago
ssh_key.go	Move login related structs and functions to models/login (#17093 )	3 years ago
ssh_key_authorized_keys.go	DBContext is just a Context (#17100 )	3 years ago
ssh_key_authorized_principals.go	DBContext is just a Context (#17100 )	3 years ago
ssh_key_deploy.go	Move login related structs and functions to models/login (#17093 )	3 years ago
ssh_key_fingerprint.go	Move db related basic functions to models/db (#17075 )	3 years ago
ssh_key_parse.go	refactor: move from io/ioutil to io and os package (#17109 )	3 years ago
ssh_key_principals.go	Move EmailAddress & UserRedirect into models/user/ (#17607 )	3 years ago
ssh_key_test.go	Add support for ed25519_sk and ecdsa_sk SSH keys (#13462 )	4 years ago
star.go	Move login related structs and functions to models/login (#17093 )	3 years ago
star_test.go	Decouple unit test, remove intermediate `unittestbridge` package (#17662 )	3 years ago
statistic.go	Move webhook into models/webhook/ (#17579 )	3 years ago
task.go	Move migrations into services and base into modules/migration (#17663 )	3 years ago
token.go	Fix problem when database ID is not incremented as expected (#17229 )	3 years ago
token_test.go	Decouple unit test, remove intermediate `unittestbridge` package (#17662 )	3 years ago
topic.go	Move login related structs and functions to models/login (#17093 )	3 years ago
topic_test.go	Decouple unit test code from business code (#17623 )	3 years ago
update.go	DBContext is just a Context (#17100 )	3 years ago
upload.go	DBContext is just a Context (#17100 )	3 years ago
user.go	Multiple Escaping Improvements (#17551 )	3 years ago
user_avatar.go	In many cases user avatar link should be an absolute URL with http host (#17420 )	3 years ago
user_email.go	Move EmailAddress & UserRedirect into models/user/ (#17607 )	3 years ago
user_email_test.go	Decouple unit test code from business code (#17623 )	3 years ago
user_follow.go	DBContext is just a Context (#17100 )	3 years ago
user_follow_test.go	Decouple unit test, remove intermediate `unittestbridge` package (#17662 )	3 years ago
user_heatmap.go	DBContext is just a Context (#17100 )	3 years ago
user_heatmap_test.go	Decouple unit test, remove intermediate `unittestbridge` package (#17662 )	3 years ago
user_openid.go	DBContext is just a Context (#17100 )	3 years ago
user_openid_test.go	Decouple unit test code from business code (#17623 )	3 years ago
user_test.go	Decouple unit test, remove intermediate `unittestbridge` package (#17662 )	3 years ago
userlist.go	Move twofactor to models/login (#17143 )	3 years ago
userlist_test.go	Decouple unit test code from business code (#17623 )	3 years ago
wiki.go	Handle and propagate errors when checking if paths are Dirs, Files or Exist (#13186 )	4 years ago
wiki_test.go	Decouple unit test, remove intermediate `unittestbridge` package (#17662 )	3 years ago