From bb3e417a58861f96c0303ecf12b2cc9321cb018e Mon Sep 17 00:00:00 2001 From: Sebastian Sdorra Date: Thu, 10 May 2012 18:53:56 +0200 Subject: [PATCH 1/6] improve validation of repository name --- .../java/sonia/scm/util/ValidationUtil.java | 9 ++++++--- .../sonia/scm/util/ValidationUtilTest.java | 18 ++++++++++++++++++ 2 files changed, 24 insertions(+), 3 deletions(-) diff --git a/scm-core/src/main/java/sonia/scm/util/ValidationUtil.java b/scm-core/src/main/java/sonia/scm/util/ValidationUtil.java index c46bdc7432..42695421eb 100644 --- a/scm-core/src/main/java/sonia/scm/util/ValidationUtil.java +++ b/scm-core/src/main/java/sonia/scm/util/ValidationUtil.java @@ -52,10 +52,12 @@ public class ValidationUtil private static final String REGEX_NAME = "^[A-z0-9\\.\\-_]+$"; /** Field description */ - private static final String REGEX_REPOSITORYNAME = "^[A-z0-9\\.\\-_/]+$"; + private static final String REGEX_REPOSITORYNAME = + "^[A-z0-9][A-z0-9\\.\\-_/]*$"; /** Field description */ - private static final String REGEX_USERNAME = "^[A-z0-9\\.\\-_@]|[^ ]([A-z0-9\\.\\-_@ ]*[A-z0-9\\.\\-_@]|[^ ])?$"; + private static final String REGEX_USERNAME = + "^[A-z0-9\\.\\-_@]|[^ ]([A-z0-9\\.\\-_@ ]*[A-z0-9\\.\\-_@]|[^ ])?$"; //~--- get methods ---------------------------------------------------------- @@ -139,7 +141,8 @@ public class ValidationUtil */ public static boolean isRepositoryNameValid(String name) { - return Util.isNotEmpty(name) && name.matches(REGEX_REPOSITORYNAME); + return Util.isNotEmpty(name) && name.matches(REGEX_REPOSITORYNAME) + &&!name.contains("..") &&!name.endsWith("/.") &&!name.endsWith("."); } /** diff --git a/scm-core/src/test/java/sonia/scm/util/ValidationUtilTest.java b/scm-core/src/test/java/sonia/scm/util/ValidationUtilTest.java index b29ed007ce..00b8f7574a 100644 --- a/scm-core/src/test/java/sonia/scm/util/ValidationUtilTest.java +++ b/scm-core/src/test/java/sonia/scm/util/ValidationUtilTest.java @@ -130,6 +130,24 @@ public class ValidationUtilTest assertFalse(ValidationUtil.isNotContaining("test", "t")); } + /** + * Method description + * + */ + @Test + public void testIsRepositoryNameValid() + { + assertTrue(ValidationUtil.isRepositoryNameValid("scm")); + assertTrue(ValidationUtil.isRepositoryNameValid("scm/main")); + assertTrue(ValidationUtil.isRepositoryNameValid("scm/plugins/git-plugin")); + + // issue 142 + assertFalse(ValidationUtil.isRepositoryNameValid(".")); + assertFalse(ValidationUtil.isRepositoryNameValid(".scm/plugins")); + assertTrue(ValidationUtil.isRepositoryNameValid("scm/plugins/.")); + assertFalse(ValidationUtil.isRepositoryNameValid("scm/../plugins")); + } + /** * Method description * From 6c48c22529b361526bab33c784ac2580cb945173 Mon Sep 17 00:00:00 2001 From: Sebastian Sdorra Date: Thu, 10 May 2012 18:55:11 +0200 Subject: [PATCH 2/6] improve unit test for repository name validation --- .../src/test/java/sonia/scm/util/ValidationUtilTest.java | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/scm-core/src/test/java/sonia/scm/util/ValidationUtilTest.java b/scm-core/src/test/java/sonia/scm/util/ValidationUtilTest.java index 00b8f7574a..c846ea737e 100644 --- a/scm-core/src/test/java/sonia/scm/util/ValidationUtilTest.java +++ b/scm-core/src/test/java/sonia/scm/util/ValidationUtilTest.java @@ -140,11 +140,14 @@ public class ValidationUtilTest assertTrue(ValidationUtil.isRepositoryNameValid("scm")); assertTrue(ValidationUtil.isRepositoryNameValid("scm/main")); assertTrue(ValidationUtil.isRepositoryNameValid("scm/plugins/git-plugin")); + assertTrue(ValidationUtil.isRepositoryNameValid("s")); + assertTrue(ValidationUtil.isRepositoryNameValid("sc")); // issue 142 assertFalse(ValidationUtil.isRepositoryNameValid(".")); + assertFalse(ValidationUtil.isRepositoryNameValid("/")); assertFalse(ValidationUtil.isRepositoryNameValid(".scm/plugins")); - assertTrue(ValidationUtil.isRepositoryNameValid("scm/plugins/.")); + assertFalse(ValidationUtil.isRepositoryNameValid("scm/plugins/.")); assertFalse(ValidationUtil.isRepositoryNameValid("scm/../plugins")); } From 17ab9e60b9a6f238ac3bc0997b3a73790b434520 Mon Sep 17 00:00:00 2001 From: Sebastian Sdorra Date: Thu, 10 May 2012 19:08:26 +0200 Subject: [PATCH 3/6] repository names should not end with a slash --- scm-core/src/main/java/sonia/scm/util/ValidationUtil.java | 3 ++- scm-core/src/test/java/sonia/scm/util/ValidationUtilTest.java | 2 ++ 2 files changed, 4 insertions(+), 1 deletion(-) diff --git a/scm-core/src/main/java/sonia/scm/util/ValidationUtil.java b/scm-core/src/main/java/sonia/scm/util/ValidationUtil.java index 42695421eb..c9a042c79a 100644 --- a/scm-core/src/main/java/sonia/scm/util/ValidationUtil.java +++ b/scm-core/src/main/java/sonia/scm/util/ValidationUtil.java @@ -142,7 +142,8 @@ public class ValidationUtil public static boolean isRepositoryNameValid(String name) { return Util.isNotEmpty(name) && name.matches(REGEX_REPOSITORYNAME) - &&!name.contains("..") &&!name.endsWith("/.") &&!name.endsWith("."); + &&!name.contains("..") &&!name.endsWith("/.") &&!name.endsWith(".") + &&!name.endsWith("/"); } /** diff --git a/scm-core/src/test/java/sonia/scm/util/ValidationUtilTest.java b/scm-core/src/test/java/sonia/scm/util/ValidationUtilTest.java index c846ea737e..c95d0f88ce 100644 --- a/scm-core/src/test/java/sonia/scm/util/ValidationUtilTest.java +++ b/scm-core/src/test/java/sonia/scm/util/ValidationUtilTest.java @@ -149,6 +149,8 @@ public class ValidationUtilTest assertFalse(ValidationUtil.isRepositoryNameValid(".scm/plugins")); assertFalse(ValidationUtil.isRepositoryNameValid("scm/plugins/.")); assertFalse(ValidationUtil.isRepositoryNameValid("scm/../plugins")); + assertFalse(ValidationUtil.isRepositoryNameValid("scm/main/")); + assertFalse(ValidationUtil.isRepositoryNameValid("/scm/main/")); } /** From 0ca618bd035160a2e020ed12ad7b53c072826f16 Mon Sep 17 00:00:00 2001 From: Sebastian Sdorra Date: Thu, 10 May 2012 19:08:54 +0200 Subject: [PATCH 4/6] improve client side validation for repository names --- scm-webapp/src/main/webapp/index.html | 3 ++ .../resources/js/override/ext.form.vtypes.js | 6 ++- .../main/webapp/resources/js/sonia.core.js | 39 +++++++++++++++++++ 3 files changed, 47 insertions(+), 1 deletion(-) create mode 100644 scm-webapp/src/main/webapp/resources/js/sonia.core.js diff --git a/scm-webapp/src/main/webapp/index.html b/scm-webapp/src/main/webapp/index.html index e2055a8b7c..6b727a0b2a 100644 --- a/scm-webapp/src/main/webapp/index.html +++ b/scm-webapp/src/main/webapp/index.html @@ -55,6 +55,9 @@ + + + diff --git a/scm-webapp/src/main/webapp/resources/js/override/ext.form.vtypes.js b/scm-webapp/src/main/webapp/resources/js/override/ext.form.vtypes.js index 1f7158ff7e..cbbeb2a721 100644 --- a/scm-webapp/src/main/webapp/resources/js/override/ext.form.vtypes.js +++ b/scm-webapp/src/main/webapp/resources/js/override/ext.form.vtypes.js @@ -53,7 +53,11 @@ Ext.apply(Ext.form.VTypes, { // repository name validator repositoryName: function(val){ - return /^[A-z0-9\.\-_\/]+$/.test(val); + return /^[A-z0-9][A-z0-9\.\-_\/]*$/.test(val) + && ! val.contains('..') + && ! val.endsWith('/.') + && ! val.endsWith('/') + && ! val.endsWith('.'); }, repositoryNameText: 'The name of the repository is invalid.', diff --git a/scm-webapp/src/main/webapp/resources/js/sonia.core.js b/scm-webapp/src/main/webapp/resources/js/sonia.core.js new file mode 100644 index 0000000000..474eb4c992 --- /dev/null +++ b/scm-webapp/src/main/webapp/resources/js/sonia.core.js @@ -0,0 +1,39 @@ +/* * + * Copyright (c) 2010, Sebastian Sdorra + * All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions are met: + * + * 1. Redistributions of source code must retain the above copyright notice, + * this list of conditions and the following disclaimer. + * 2. Redistributions in binary form must reproduce the above copyright notice, + * this list of conditions and the following disclaimer in the documentation + * and/or other materials provided with the distribution. + * 3. Neither the name of SCM-Manager; nor the names of its + * contributors may be used to endorse or promote products derived from this + * software without specific prior written permission. + * + * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" + * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE + * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE + * DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE FOR ANY + * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES + * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; + * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON + * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT + * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS + * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + * + * http://bitbucket.org/sdorra/scm-manager + * + */ + + +String.prototype.endsWith = function(suffix) { + return this.indexOf(suffix, this.length - suffix.length) !== -1; +}; + +String.prototype.contains = function(val) { + return this.indexOf(val) >= 0; +}; From 9850fbbda58cb4f2ad1a5e45a4341723f187959c Mon Sep 17 00:00:00 2001 From: Sebastian Sdorra Date: Fri, 11 May 2012 17:00:19 +0200 Subject: [PATCH 5/6] do not allow "/./" or "//" in repository names --- scm-core/src/main/java/sonia/scm/util/ValidationUtil.java | 2 +- scm-core/src/test/java/sonia/scm/util/ValidationUtilTest.java | 4 ++++ .../src/main/webapp/resources/js/override/ext.form.vtypes.js | 4 +++- 3 files changed, 8 insertions(+), 2 deletions(-) diff --git a/scm-core/src/main/java/sonia/scm/util/ValidationUtil.java b/scm-core/src/main/java/sonia/scm/util/ValidationUtil.java index c9a042c79a..5e241b4b09 100644 --- a/scm-core/src/main/java/sonia/scm/util/ValidationUtil.java +++ b/scm-core/src/main/java/sonia/scm/util/ValidationUtil.java @@ -143,7 +143,7 @@ public class ValidationUtil { return Util.isNotEmpty(name) && name.matches(REGEX_REPOSITORYNAME) &&!name.contains("..") &&!name.endsWith("/.") &&!name.endsWith(".") - &&!name.endsWith("/"); + &&!name.endsWith("/") &&!name.contains("/./") &&!name.contains("//"); } /** diff --git a/scm-core/src/test/java/sonia/scm/util/ValidationUtilTest.java b/scm-core/src/test/java/sonia/scm/util/ValidationUtilTest.java index c95d0f88ce..388bb768bf 100644 --- a/scm-core/src/test/java/sonia/scm/util/ValidationUtilTest.java +++ b/scm-core/src/test/java/sonia/scm/util/ValidationUtilTest.java @@ -151,6 +151,10 @@ public class ValidationUtilTest assertFalse(ValidationUtil.isRepositoryNameValid("scm/../plugins")); assertFalse(ValidationUtil.isRepositoryNameValid("scm/main/")); assertFalse(ValidationUtil.isRepositoryNameValid("/scm/main/")); + + // issue 144 + assertFalse(ValidationUtil.isRepositoryNameValid("scm/./main")); + assertFalse(ValidationUtil.isRepositoryNameValid("scm//main")); } /** diff --git a/scm-webapp/src/main/webapp/resources/js/override/ext.form.vtypes.js b/scm-webapp/src/main/webapp/resources/js/override/ext.form.vtypes.js index cbbeb2a721..d3f4def73a 100644 --- a/scm-webapp/src/main/webapp/resources/js/override/ext.form.vtypes.js +++ b/scm-webapp/src/main/webapp/resources/js/override/ext.form.vtypes.js @@ -57,7 +57,9 @@ Ext.apply(Ext.form.VTypes, { && ! val.contains('..') && ! val.endsWith('/.') && ! val.endsWith('/') - && ! val.endsWith('.'); + && ! val.endsWith('.') + && ! val.contains('/./') + && ! val.contains('//'); }, repositoryNameText: 'The name of the repository is invalid.', From f155b3add6549a166298b78a23cdeec3bfae1920 Mon Sep 17 00:00:00 2001 From: Sebastian Sdorra Date: Fri, 11 May 2012 17:14:35 +0200 Subject: [PATCH 6/6] close branch issue-142