Fix username rendering bug (#2122)
* Fix username rendering bug * XSS integration test * Migration to unescape user full namesforgejo
parent
2c3efd72ce
commit
858324c21a
@ -0,0 +1,37 @@
|
|||||||
|
// Copyright 2017 The Gitea Authors. All rights reserved.
|
||||||
|
// Use of this source code is governed by a MIT-style
|
||||||
|
// license that can be found in the LICENSE file.
|
||||||
|
|
||||||
|
package integrations
|
||||||
|
|
||||||
|
import (
|
||||||
|
"net/http"
|
||||||
|
"testing"
|
||||||
|
|
||||||
|
"code.gitea.io/gitea/models"
|
||||||
|
|
||||||
|
"github.com/stretchr/testify/assert"
|
||||||
|
)
|
||||||
|
|
||||||
|
func TestXSSUserFullName(t *testing.T) {
|
||||||
|
prepareTestEnv(t)
|
||||||
|
user := models.AssertExistsAndLoadBean(t, &models.User{ID: 2}).(*models.User)
|
||||||
|
const fullName = `name & <script class="evil">alert('Oh no!');</script>`
|
||||||
|
|
||||||
|
session := loginUser(t, user.Name)
|
||||||
|
req := NewRequestWithValues(t, "POST", "/user/settings", map[string]string{
|
||||||
|
"_csrf": GetCSRF(t, session, "/user/settings"),
|
||||||
|
"name": user.Name,
|
||||||
|
"full_name": fullName,
|
||||||
|
"email": user.Email,
|
||||||
|
})
|
||||||
|
session.MakeRequest(t, req, http.StatusFound)
|
||||||
|
|
||||||
|
req = NewRequestf(t, "GET", "/%s", user.Name)
|
||||||
|
resp := session.MakeRequest(t, req, http.StatusOK)
|
||||||
|
htmlDoc := NewHTMLParser(t, resp.Body)
|
||||||
|
assert.EqualValues(t, 0, htmlDoc.doc.Find("script.evil").Length())
|
||||||
|
assert.EqualValues(t, fullName,
|
||||||
|
htmlDoc.doc.Find("div.content").Find(".header.text.center").Text(),
|
||||||
|
)
|
||||||
|
}
|
@ -0,0 +1,32 @@
|
|||||||
|
// Copyright 2017 The Gitea Authors. All rights reserved.
|
||||||
|
// Use of this source code is governed by a MIT-style
|
||||||
|
// license that can be found in the LICENSE file.
|
||||||
|
|
||||||
|
package migrations
|
||||||
|
|
||||||
|
import (
|
||||||
|
"html"
|
||||||
|
|
||||||
|
"code.gitea.io/gitea/models"
|
||||||
|
|
||||||
|
"github.com/go-xorm/xorm"
|
||||||
|
)
|
||||||
|
|
||||||
|
func unescapeUserFullNames(x *xorm.Engine) (err error) {
|
||||||
|
const batchSize = 100
|
||||||
|
for start := 0; ; start += batchSize {
|
||||||
|
users := make([]*models.User, 0, batchSize)
|
||||||
|
if err := x.Limit(start, batchSize).Find(users); err != nil {
|
||||||
|
return err
|
||||||
|
}
|
||||||
|
if len(users) == 0 {
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
for _, user := range users {
|
||||||
|
user.FullName = html.UnescapeString(user.FullName)
|
||||||
|
if _, err := x.Cols("full_name").Update(user); err != nil {
|
||||||
|
return err
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
Loading…
Reference in New Issue