clawbot
7a34fc999c
All checks were successful
Check / check (push) Successful in 4s
Bumps golangci-lint from v2.10.1 to v2.12.2 everywhere it is pinned and installs the canonical `.golangci.yml`, then fixes every finding the new linter surfaces so `make check` is green. ## Version pins - `Dockerfile` lint stage: `golangci/golangci-lint:v2.12.2` (Debian-based), tag plus digest pin - `script/bootstrap`: `GOLANGCI_LINT_VERSION=2.12.2` with updated `linux-amd64`/`linux-arm64` release-archive sha256 pins ## Config `.golangci.yml` replaced with the canonical config. Material change: the old file declared `version: "2"` but kept settings under the legacy top-level `linters-settings` key, which golangci-lint v2 ignores — so the intended thresholds (`lll` 88, `funlen` 80/50, `cyclop` 15, `dupl` 100) were not being applied. The canonical file moves them under `linters.settings` and drops `issues.exclude-use-default`. ## Lint fixes (216 findings) - `lll` (96): wrapped lines to the 88-column limit - `noctx` (46): `httptest.NewRequestWithContext` with `t.Context()` throughout the tests - `goconst` (24): shared constants for template/JSON keys in `internal/handlers` and repeated test literals - `gosec` (23): app-page redirects now go through a `redirectToApp` helper that path-escapes the app ID (G710 open redirect); `http.ServeFile` of the internally derived deployment log path annotated like the adjacent `os.Stat` (G703) - `dupl` (22): extracted a generic `findAllByAppID` in `internal/models`, a `deleteAppResource` helper in `internal/handlers`, a shared `parsePush` in `internal/service/webhook`, and table-driven/helper-based dedup in tests - `nolintlint` (5): removed `//nolint:funlen` directives made obsolete by the new limits (plus one more that became obsolete after refactoring) - `nilerr` (3, surfaced during fixing): resource-delete lookups now propagate the find error to the caller No behavior changes intended; all tests pass and `make check` is green. Note: golangci-lint v2.12 warns that `gomodguard` is deprecated in favor of `gomodguard_v2` — a future canonical-config update should address this centrally. Co-authored-by: sneak <sneak@sneak.berlin> Reviewed-on: #187 Co-authored-by: clawbot <clawbot@noreply.example.org> Co-committed-by: clawbot <clawbot@noreply.example.org>
77 lines
2.5 KiB
Go
77 lines
2.5 KiB
Go
package handlers_test
|
|
|
|
import (
|
|
"testing"
|
|
|
|
"sneak.berlin/go/upaas/internal/handlers"
|
|
)
|
|
|
|
func TestValidateRepoURL(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
tests := []struct {
|
|
name string
|
|
url string
|
|
wantErr bool
|
|
}{
|
|
// Valid URLs
|
|
{name: "https URL", url: "https://github.com/user/repo.git", wantErr: false},
|
|
{name: "http URL", url: "http://github.com/user/repo.git", wantErr: false},
|
|
{name: "ssh URL", url: "ssh://git@github.com/user/repo.git", wantErr: false},
|
|
{name: "git URL", url: "git://github.com/user/repo.git", wantErr: false},
|
|
{name: "SCP-like URL", url: "git@github.com:user/repo.git", wantErr: false},
|
|
{name: "SCP-like with dots", url: "git@git.example.com:org/repo.git", wantErr: false},
|
|
{name: "https without .git", url: "https://github.com/user/repo", wantErr: false},
|
|
{
|
|
name: "https with port",
|
|
url: "https://git.example.com:8443/user/repo.git",
|
|
wantErr: false,
|
|
},
|
|
|
|
// Invalid URLs
|
|
{name: "empty string", url: "", wantErr: true},
|
|
{name: "whitespace only", url: " ", wantErr: true},
|
|
{name: "file URL", url: "file:///etc/passwd", wantErr: true},
|
|
{name: "file URL uppercase", url: "FILE:///etc/passwd", wantErr: true},
|
|
{name: "bare path", url: "/some/local/path", wantErr: true},
|
|
{name: "relative path", url: "../repo", wantErr: true},
|
|
{name: "just a word", url: "notaurl", wantErr: true},
|
|
{name: "ftp URL", url: "ftp://example.com/repo.git", wantErr: true},
|
|
{name: "no host https", url: "https:///path", wantErr: true},
|
|
{name: "no path https", url: "https://github.com", wantErr: true},
|
|
{name: "no path https trailing slash", url: "https://github.com/", wantErr: true},
|
|
{name: "SCP-like non-git user", url: "root@github.com:user/repo.git", wantErr: true},
|
|
{
|
|
name: "SCP-like arbitrary user",
|
|
url: "admin@github.com:user/repo.git",
|
|
wantErr: true,
|
|
},
|
|
{name: "path traversal SCP", url: "git@github.com:../../etc/passwd", wantErr: true},
|
|
{
|
|
name: "path traversal https",
|
|
url: "https://github.com/user/../../../etc/passwd",
|
|
wantErr: true,
|
|
},
|
|
{
|
|
name: "path traversal in middle",
|
|
url: "https://github.com/user/repo/../secret",
|
|
wantErr: true,
|
|
},
|
|
}
|
|
|
|
for _, tc := range tests {
|
|
t.Run(tc.name, func(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
err := handlers.ValidateRepoURLForTest(tc.url)
|
|
if tc.wantErr && err == nil {
|
|
t.Errorf("ValidateRepoURLForTest(%q) = nil, want error", tc.url)
|
|
}
|
|
|
|
if !tc.wantErr && err != nil {
|
|
t.Errorf("ValidateRepoURLForTest(%q) = %v, want nil", tc.url, err)
|
|
}
|
|
})
|
|
}
|
|
}
|