Gitea-John71/Gitea
2
0
Fork 0
mirror of https://github.com/go-gitea/gitea.git synced 2026-08-24 19:34:38 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(actions): verify raw artifact signatures first (#39049)

Browse Source 
Validate raw-artifact signatures before resolving the requested
artifact.

---------

Co-authored-by: silverwind <me@silverwind.io>
This commit is contained in:
bircni
2026-08-22 20:47:55 +02:00
committed by GitHub
parent 51e42d4b11
commit 5fc3cec87f
2 changed files with 38 additions and 38 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/integration/api_actions_artifact_v4_test.go
+19 -18
View File
@@ -662,10 +662,25 @@ func TestActionsArtifactV4DownloadSinglePublicApi(t *testing.T) {
body := strings.Repeat("D", 1024)
assert.Equal(t, body, resp.Body.String())
// confirm artifact can not be downloaded without query
req = NewRequestWithBody(t, "GET", blobLocation, nil)
req = NewRequestWithBody(t, "GET", blobLocation, nil).AddTokenAuth(token)
req.URL.RawQuery = ""
_ = MakeRequest(t, req, http.StatusUnauthorized)
notFoundResp := MakeRequest(t, req, http.StatusNotFound)
otherRepo := unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: 1})
require.NotEqual(t, repo.ID, otherRepo.ID)
for _, testCase := range []struct {
name string
path string
}{
{"other repository", fmt.Sprintf("/api/v1/repos/%s/actions/artifacts/%d/zip/raw", otherRepo.FullName(), listResp.Entries[0].ID)},
{"missing artifact", fmt.Sprintf("/api/v1/repos/%s/actions/artifacts/0/zip/raw", repo.FullName())},
{"missing repository", fmt.Sprintf("/api/v1/repos/%s/does-not-exist/actions/artifacts/%d/zip/raw", repo.OwnerName, listResp.Entries[0].ID)},
} {
t.Run(testCase.name, func(t *testing.T) {
invalidResp := MakeRequest(t, NewRequestWithBody(t, "GET", testCase.path, nil), http.StatusNotFound)
assert.Equal(t, notFoundResp.Body.String(), invalidResp.Body.String())
})
}
}
func TestActionsArtifactV4DownloadSinglePublicApiPrivateRepo(t *testing.T) {
@@ -703,7 +718,7 @@ func TestActionsArtifactV4DownloadSinglePublicApiPrivateRepo(t *testing.T) {
// confirm artifact can not be downloaded without query
req = NewRequestWithBody(t, "GET", blobLocation, nil)
req.URL.RawQuery = ""
_ = MakeRequest(t, req, http.StatusUnauthorized)
_ = MakeRequest(t, req, http.StatusNotFound)
}
func TestActionsArtifactV4ListAndGetPublicApi(t *testing.T) {
@@ -783,20 +798,6 @@ func TestActionsArtifactV4DownloadArtifactCorrectRepoFound(t *testing.T) {
MakeRequest(t, req, http.StatusFound)
}
func TestActionsArtifactV4DownloadRawArtifactCorrectRepoMissingSignatureUnauthorized(t *testing.T) {
defer prepareTestEnvActionsArtifacts(t)()
repo := unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: 4})
user := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: repo.OwnerID})
session := loginUser(t, user.Name)
token := getTokenForLoggedInUser(t, session, auth_model.AccessTokenScopeWriteRepository)
// confirm cannot use the raw artifact endpoint even with a correct access token
req := NewRequestWithBody(t, "GET", fmt.Sprintf("/api/v1/repos/%s/actions/artifacts/%d/zip/raw", repo.FullName(), 22), nil).
AddTokenAuth(token)
MakeRequest(t, req, http.StatusUnauthorized)
}
func TestActionsArtifactV4Delete(t *testing.T) {
defer prepareTestEnvActionsArtifacts(t)()