mirror of
https://github.com/go-gitea/gitea.git
synced 2026-10-03 15:28:55 +00:00
silverwind
cf89ecd887
The `gitea.com/go-chi/session` package only exists for Gitea, so it moves into `modules/session` to fix its bugs directly. Fixes the flake in https://github.com/go-gitea/gitea/actions/runs/36726154500/job/109923538400. - Sessions are only written back when changed, so a read-only request can't revert a concurrent change or restore a logged-out session, like https://github.com/go-macaron/session/commit/ae808a4a4660c802965c834299ab08f167effd12 - The session cookie is only set once a session holds data - Every backend refreshes the expiry on load and file sessions are written atomically - Also fix https://github.com/go-gitea/gitea/issues/36176 ## ⚠️ BREAKING ⚠️ * the `mysql`, `postgres`, `couchbase` and `memcache` session providers are removed, use `file`, `db` or `redis` instead * login-related cookies are renamed to `gitea_session` and `gitea_remember`, if you'd like to use the old names, set `COOKIE_NAME` and `COOKIE_REMEMBER_NAME` in app.ini --------- Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
77 lines
2.8 KiB
Go
77 lines
2.8 KiB
Go
// Copyright 2023 The Gitea Authors. All rights reserved.
|
|
// SPDX-License-Identifier: MIT
|
|
|
|
package context
|
|
|
|
import (
|
|
"errors"
|
|
"net/http"
|
|
"net/http/httptest"
|
|
"net/url"
|
|
"strings"
|
|
"testing"
|
|
|
|
"gitea.dev/modules/reqctx"
|
|
"gitea.dev/modules/setting"
|
|
"gitea.dev/modules/test"
|
|
|
|
"github.com/stretchr/testify/assert"
|
|
)
|
|
|
|
func TestServerErrorFetchActionRespondsJSON(t *testing.T) {
|
|
req, _ := http.NewRequest(http.MethodPost, "/", nil)
|
|
req.Header.Add("X-Gitea-Fetch-Action", "1")
|
|
resp := httptest.NewRecorder()
|
|
ctx := NewWebContext(NewBaseContextForTest(t, resp, req), nil, nil)
|
|
ctx.ServerError("test", errors.New("boom"))
|
|
assert.Equal(t, http.StatusInternalServerError, resp.Code)
|
|
assert.Contains(t, resp.Header().Get("Content-Type"), "application/json")
|
|
assert.JSONEq(t, `{"errorMessage":"test, error: boom","renderFormat":"text"}`, resp.Body.String())
|
|
}
|
|
|
|
func TestRedirectToCurrentSite(t *testing.T) {
|
|
defer test.MockVariableValue(&setting.AppURL, "http://localhost:3000/sub/")()
|
|
defer test.MockVariableValue(&setting.AppSubURL, "/sub")()
|
|
cases := []struct {
|
|
location string
|
|
want string
|
|
}{
|
|
{"/", "/sub/"},
|
|
{"http://localhost:3000/sub?k=v", "http://localhost:3000/sub?k=v"},
|
|
{"http://other", "/sub/"},
|
|
}
|
|
for _, c := range cases {
|
|
t.Run(c.location, func(t *testing.T) {
|
|
req := &http.Request{URL: &url.URL{Path: "/"}}
|
|
resp := httptest.NewRecorder()
|
|
base := NewBaseContextForTest(t, resp, req)
|
|
ctx := NewWebContext(base, nil, nil)
|
|
ctx.RedirectToCurrentSite(c.location)
|
|
redirect := test.RedirectURL(resp)
|
|
assert.Equal(t, c.want, redirect)
|
|
})
|
|
}
|
|
}
|
|
|
|
func TestAppFullLink(t *testing.T) {
|
|
defer test.MockVariableValue(&setting.AppURL, "https://gitea.example.com/sub/")()
|
|
defer test.MockVariableValue(&setting.AppSubURL, "/sub")()
|
|
defer test.MockVariableValue(&setting.PublicURLDetection, setting.PublicURLNever)()
|
|
|
|
req := httptest.NewRequest(http.MethodGet, "https://gitea.example.com/sub/", nil)
|
|
tmplCtx := NewTemplateContext(reqctx.NewRequestContextForTest(t), req)
|
|
|
|
assert.Equal(t, "https://gitea.example.com/sub", string(tmplCtx.AppFullLink()))
|
|
assert.Equal(t, "https://gitea.example.com/sub/user/repo", string(tmplCtx.AppFullLink("user/repo")))
|
|
assert.Equal(t, "https://gitea.example.com/sub/user/repo", string(tmplCtx.AppFullLink("/user/repo")))
|
|
}
|
|
|
|
func TestHeadMetaContentSecurityPolicy(t *testing.T) {
|
|
tmplCtx := NewTemplateContext(reqctx.NewRequestContextForTest(t), nil)
|
|
nonce := tmplCtx.CspScriptNonce()
|
|
assert.Equal(t, `<meta http-equiv="Content-Security-Policy" content="default-src * data: blob:;script-src * 'nonce-`+nonce+`';style-src * 'unsafe-inline';">`, string(tmplCtx.HeadMetaContentSecurityPolicy()))
|
|
assert.False(t, strings.ContainsAny(WebContentSecurityPolicy(nonce), `"<>&`))
|
|
defer test.MockVariableValue(&setting.Security.ContentSecurityPolicyGeneral, "unset")()
|
|
assert.Empty(t, tmplCtx.HeadMetaContentSecurityPolicy())
|
|
}
|