02f0a12626
- Changed SCP regex to only accept 'git' as the username - Added path traversal check: reject URLs containing '..' - Added test cases for non-git users and path traversal
57 lines
2.3 KiB
Go
57 lines
2.3 KiB
Go
package handlers
|
|
|
|
import "testing"
|
|
|
|
func TestValidateRepoURL(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
tests := []struct {
|
|
name string
|
|
url string
|
|
wantErr bool
|
|
}{
|
|
// Valid URLs
|
|
{name: "https URL", url: "https://github.com/user/repo.git", wantErr: false},
|
|
{name: "http URL", url: "http://github.com/user/repo.git", wantErr: false},
|
|
{name: "ssh URL", url: "ssh://git@github.com/user/repo.git", wantErr: false},
|
|
{name: "git URL", url: "git://github.com/user/repo.git", wantErr: false},
|
|
{name: "SCP-like URL", url: "git@github.com:user/repo.git", wantErr: false},
|
|
{name: "SCP-like with dots", url: "git@git.example.com:org/repo.git", wantErr: false},
|
|
{name: "https without .git", url: "https://github.com/user/repo", wantErr: false},
|
|
{name: "https with port", url: "https://git.example.com:8443/user/repo.git", wantErr: false},
|
|
|
|
// Invalid URLs
|
|
{name: "empty string", url: "", wantErr: true},
|
|
{name: "whitespace only", url: " ", wantErr: true},
|
|
{name: "file URL", url: "file:///etc/passwd", wantErr: true},
|
|
{name: "file URL uppercase", url: "FILE:///etc/passwd", wantErr: true},
|
|
{name: "bare path", url: "/some/local/path", wantErr: true},
|
|
{name: "relative path", url: "../repo", wantErr: true},
|
|
{name: "just a word", url: "notaurl", wantErr: true},
|
|
{name: "ftp URL", url: "ftp://example.com/repo.git", wantErr: true},
|
|
{name: "no host https", url: "https:///path", wantErr: true},
|
|
{name: "no path https", url: "https://github.com", wantErr: true},
|
|
{name: "no path https trailing slash", url: "https://github.com/", wantErr: true},
|
|
{name: "SCP-like non-git user", url: "root@github.com:user/repo.git", wantErr: true},
|
|
{name: "SCP-like arbitrary user", url: "admin@github.com:user/repo.git", wantErr: true},
|
|
{name: "path traversal SCP", url: "git@github.com:../../etc/passwd", wantErr: true},
|
|
{name: "path traversal https", url: "https://github.com/user/../../../etc/passwd", wantErr: true},
|
|
{name: "path traversal in middle", url: "https://github.com/user/repo/../secret", wantErr: true},
|
|
}
|
|
|
|
for _, tc := range tests {
|
|
t.Run(tc.name, func(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
err := validateRepoURL(tc.url)
|
|
if tc.wantErr && err == nil {
|
|
t.Errorf("validateRepoURL(%q) = nil, want error", tc.url)
|
|
}
|
|
|
|
if !tc.wantErr && err != nil {
|
|
t.Errorf("validateRepoURL(%q) = %v, want nil", tc.url, err)
|
|
}
|
|
})
|
|
}
|
|
}
|