mirror of
https://github.com/gogs/gogs.git
synced 2026-02-28 01:00:57 +01:00
997011bfb2
Add previously covered autolink test cases that were dropped during the goldmark migration (hosts without dots, https variants, single-digit issues, cross-repo issues). Add new test suites for link rewriting with both path-only and absolute URL prefixes, and for HTML passthrough behavior confirming raw HTML is stripped without WithUnsafe. Sanitize RawMarkdown output in the server notice banner to prevent potential XSS, since it was the only call site not passing through SanitizeBytes. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
59 lines
1.3 KiB
Go
59 lines
1.3 KiB
Go
package context
|
|
|
|
import (
|
|
"os"
|
|
"path/filepath"
|
|
|
|
log "unknwon.dev/clog/v2"
|
|
|
|
"gogs.io/gogs/internal/conf"
|
|
"gogs.io/gogs/internal/markup"
|
|
"gogs.io/gogs/internal/osutil"
|
|
"gogs.io/gogs/internal/tool"
|
|
)
|
|
|
|
// renderNoticeBanner checks if a notice banner file exists and loads the message to display
|
|
// on all pages.
|
|
func (c *Context) renderNoticeBanner() {
|
|
fpath := filepath.Join(conf.CustomDir(), "notice", "banner.md")
|
|
if !osutil.Exist(fpath) {
|
|
return
|
|
}
|
|
|
|
f, err := os.Open(fpath)
|
|
if err != nil {
|
|
log.Error("Failed to open file %q: %v", fpath, err)
|
|
return
|
|
}
|
|
defer f.Close()
|
|
|
|
fi, err := f.Stat()
|
|
if err != nil {
|
|
log.Error("Failed to stat file %q: %v", fpath, err)
|
|
return
|
|
}
|
|
|
|
// Limit size to prevent very large messages from breaking pages
|
|
var maxSize int64 = 1024
|
|
|
|
if fi.Size() > maxSize { // Refuse to print very long messages
|
|
log.Warn("Notice banner file %q size too large [%d > %d]: refusing to render", fpath, fi.Size(), maxSize)
|
|
return
|
|
}
|
|
|
|
buf := make([]byte, maxSize)
|
|
n, err := f.Read(buf)
|
|
if err != nil {
|
|
log.Error("Failed to read file %q: %v", fpath, err)
|
|
return
|
|
}
|
|
buf = buf[:n]
|
|
|
|
if !tool.IsTextFile(buf) {
|
|
log.Warn("Notice banner file %q does not appear to be a text file: aborting", fpath)
|
|
return
|
|
}
|
|
|
|
c.Data["ServerNotice"] = string(markup.SanitizeBytes(markup.RawMarkdown(buf, "")))
|
|
}
|