Nemcio/GitBucket
1
0
Fork 0
mirror of https://github.com/gitbucket/gitbucket.git synced 2025-11-12 08:25:50 +01:00
Code Issues Packages Projects Releases Wiki Activity

(refs #1523)Eliminate CR and LF in public key

Browse Source
This commit is contained in:
Naoki Takezoe
2017-04-05 01:46:57 +09:00
parent 0a08879d8c
commit 68c2f832ac
4 changed files with 35 additions and 22 deletions
Download Patch File Download Diff File Expand all files Collapse all files

22
src/main/scala/gitbucket/core/controller/AccountController.scala
View File

@@ -61,31 +61,31 @@ trait AccountControllerBase extends AccountManagementControllerBase {
val sshKeyForm = mapping(
"title" -> trim(label("Title", text(required, maxlength(100)))),
"publicKey" -> trim(label("Key" , text(required, validPublicKey)))
"publicKey" -> trim2(label("Key" , text(required, validPublicKey)))
)(SshKeyForm.apply)
val personalTokenForm = mapping(
"note" -> trim(label("Token", text(required, maxlength(100))))
"note" -> trim(label("Token", text(required, maxlength(100))))
)(PersonalTokenForm.apply)
case class NewGroupForm(groupName: String, description: Option[String], url: Option[String], fileId: Option[String], members: String)
case class EditGroupForm(groupName: String, description: Option[String], url: Option[String], fileId: Option[String], members: String, clearImage: Boolean)
val newGroupForm = mapping(
"groupName" -> trim(label("Group name" ,text(required, maxlength(100), identifier, uniqueUserName, reservedNames))),
"groupName" -> trim(label("Group name" ,text(required, maxlength(100), identifier, uniqueUserName, reservedNames))),
"description" -> trim(label("Group description", optional(text()))),
"url" -> trim(label("URL" ,optional(text(maxlength(200))))),
"fileId" -> trim(label("File ID" ,optional(text()))),
"members" -> trim(label("Members" ,text(required, members)))
"url" -> trim(label("URL" ,optional(text(maxlength(200))))),
"fileId" -> trim(label("File ID" ,optional(text()))),
"members" -> trim(label("Members" ,text(required, members)))
)(NewGroupForm.apply)
val editGroupForm = mapping(
"groupName" -> trim(label("Group name" ,text(required, maxlength(100), identifier))),
"groupName" -> trim(label("Group name" ,text(required, maxlength(100), identifier))),
"description" -> trim(label("Group description", optional(text()))),
"url" -> trim(label("URL" ,optional(text(maxlength(200))))),
"fileId" -> trim(label("File ID" ,optional(text()))),
"members" -> trim(label("Members" ,text(required, members))),
"clearImage" -> trim(label("Clear image" ,boolean()))
"url" -> trim(label("URL" ,optional(text(maxlength(200))))),
"fileId" -> trim(label("File ID" ,optional(text()))),
"members" -> trim(label("Members" ,text(required, members))),
"clearImage" -> trim(label("Clear image" ,boolean()))
)(EditGroupForm.apply)
case class RepositoryCreationForm(owner: String, name: String, description: Option[String], isPrivate: Boolean, createReadme: Boolean)

12
src/main/scala/gitbucket/core/controller/ControllerBase.scala
View File

@@ -159,6 +159,18 @@ abstract class ControllerBase extends ScalatraFilter
if (path.startsWith("http")) path
else baseUrl + super.url(path, params, false, false, false)
/**
* Extends scalatra-form's trim rule to eliminate CR and LF.
*/
protected def trim2[T](valueType: SingleValueType[T]): SingleValueType[T] = new SingleValueType[T](){
def convert(value: String, messages: Messages): T = valueType.convert(trim(value), messages)
override def validate(name: String, value: String, params: Map[String, String], messages: Messages): Seq[(String, String)] =
valueType.validate(name, trim(value), params, messages)
private def trim(value: String): String = if(value == null) null else value.replaceAll("\r\n", "").trim
}
/**
* Use this method to response the raw data against XSS.
*/

2
src/main/scala/gitbucket/core/controller/RepositorySettingsController.scala
View File

@@ -63,7 +63,7 @@ trait RepositorySettingsControllerBase extends ControllerBase {
val deployKeyForm = mapping(
"title" -> trim(label("Title", text(required, maxlength(100)))),
"publicKey" -> trim(label("Key" , text(required))), // TODO duplication check in the repository?
"publicKey" -> trim2(label("Key" , text(required))), // TODO duplication check in the repository?
"allowWrite" -> trim(label("Key" , boolean()))
)(DeployKeyForm.apply)

21
src/main/scala/gitbucket/core/ssh/SshUtil.scala
View File

@@ -18,16 +18,17 @@ object SshUtil {
val parts = key.split(" ")
if (parts.size < 2) {
logger.debug(s"Invalid PublicKey Format: ${key}")
return None
}
try {
val encodedKey = parts(1)
val decode = Base64.getDecoder.decode(Constants.encodeASCII(encodedKey))
Some(new ByteArrayBuffer(decode).getRawPublicKey)
} catch {
case e: Throwable =>
logger.debug(e.getMessage, e)
None
None
} else {
try {
val encodedKey = parts(1)
val decode = Base64.getDecoder.decode(Constants.encodeASCII(encodedKey))
Some(new ByteArrayBuffer(decode).getRawPublicKey)
} catch {
case e: Throwable =>
logger.debug(e.getMessage, e)
None
}
}
}