mirror of
https://github.com/go-gitea/gitea.git
synced 2026-10-01 18:14:54 +00:00
TheFox0x7
1b1274486c
Introduces gitproxy module which spawns a small forward proxy as scanner for git calls Replaces hostmatcher with matchlist which supports port rules Deprecates ALLOWED_DOMAINS/BLOCKED_DOMAINS and ALLOW_LOCALNETWORKS settings in migration in favor of full names we have in security configs. Removes `external` preset in favor of lax/strict modes, strict mode requiring explicit ports if they aren't standard http/s ones. Breaking changes: - `external` preset no longer works as deny rule. To enforce that, use `strict` mode and allow ranges to connect to - Wildcards are no longer accepted in IP addresses - `*` is no longer allowed as entry in lists - domain rules now use curl like syntax `*.example.com` matching subdomains but not `example.com`, `example.com` matching itself and all subdomains. `example.*` is not a valid rule - In the default `lax` mode, `[security] ALLOWED_HOST_LIST` no longer restricts public hosts, set `EGRESS_MODE = strict` to keep an exclusive list. A startup warning flags this - Invalid list entries are logged at startup, invalid `BLOCKED_HOST_LIST`/`BLOCKED_DOMAINS` entries stop it Docs: https://gitea.com/gitea/docs/pulls/557 Signed-off-by: wxiaoguang <wxiaoguang@gmail.com> Co-authored-by: silverwind <me@silverwind.io> Co-authored-by: bircni <bircni@icloud.com> Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
34 lines
1023 B
Go
34 lines
1023 B
Go
// Copyright 2026 The Gitea Authors. All rights reserved.
|
|
// SPDX-License-Identifier: MIT
|
|
|
|
package setting
|
|
|
|
import (
|
|
"testing"
|
|
|
|
"gitea.dev/modules/test"
|
|
|
|
"github.com/stretchr/testify/assert"
|
|
"github.com/stretchr/testify/require"
|
|
)
|
|
|
|
func TestLoadMigrationsFrom(t *testing.T) {
|
|
defer test.MockVariableValue(&Migrations)()
|
|
for ini, want := range map[string][3]string{
|
|
`ALLOWED_DOMAINS = github.com
|
|
BLOCKED_DOMAINS = gitlab.com
|
|
ALLOW_LOCALNETWORKS = true`: {"github.com:*,private:*,loopback:*", "gitlab.com", "strict"},
|
|
`ALLOW_LOCALNETWORKS = true`: {"private:*,loopback:*", "", "lax"},
|
|
`ALLOWED_HOST_LIST = 10.0.0.0/8
|
|
ALLOWED_DOMAINS = github.com
|
|
ALLOW_LOCALNETWORKS = true
|
|
BLOCKED_HOST_LIST = evil.com
|
|
BLOCKED_DOMAINS = gitlab.com`: {"10.0.0.0/8", "evil.com", "lax"},
|
|
} {
|
|
cfg, err := NewConfigProviderFromData("[migrations]\n" + ini)
|
|
require.NoError(t, err)
|
|
loadMigrationsFrom(cfg)
|
|
assert.Equal(t, want, [3]string{Migrations.AllowedHostList, Migrations.BlockedHostList, Migrations.EgressMode}, ini)
|
|
}
|
|
}
|