summaryrefslogtreecommitdiffstats
path: root/src/test
Commit message (Collapse)AuthorAgeFilesLines
* Add function to calculate SHA-256 has sum to StingUtils.Florian Zschocke2023-10-151-0/+6
|
* Adjust path after moving from "gitblit" to "gitblit-org" on GithubFlorian Zschocke2022-12-091-1/+1
|
* Update Bugtraq to v0.4Florian Zschocke2022-11-071-9/+30
| | | | Sync with upstream @ https://github.com/mstrap/bugtraq
* Add SSH host keys with ECDSA and Ed25519Florian Zschocke2022-10-251-0/+134
| | | | | | | | | Create new host keys, one with ECDSA and one with Ed25519 algorithms. For the Ed25519 currently the EdDSA library from i2p is used. This requires some quirks, compared to a modern BouncyCastle. But the SSHD library used cannot use BouncyCastle yet for Ed25519. No DSA key is generated anymore, but we still support existing ones.
* Update dependency MINA SSHD to version 1.7.0Florian Zschocke2022-10-091-1/+1
|
* upgrade to sshd 1.6.0, add eddsa dependency, upgrade jgit to 4.1.2ricardop2022-10-081-1/+1
| | | | | | | | | (cherry picked from commit d8fbdda2ab3fa48e92bdf37399d4b75c48409c5c@rpardini:master) # Conflicts: # .classpath # build.moxie # src/test/java/com/gitblit/tests/SshUnitTest.java
* Add init test for getting repository permissionsFlorian Zschocke2022-08-071-0/+49
|
* Add more tests for tab expansionFlorian Zschocke2022-08-021-3/+21
| | | | These show more clearly what the code is supposed to do.
* Tab to space conversion testingQuentin2022-08-021-3/+13
|
* fix: Fix StoredUserConfig not escaping control charactersFlorian Zschocke2022-03-131-0/+149
| | | | | | | | | | | | | | | | | The `StoredUserConfig` only escaped the escape character, i.e. backslash. But it does not escape control characters like tab or newline. This introduces a vulnerability where an attacker can create new entries in their user account and create new accounts. In addition, other characters are also not properly handled. Field values with a comment character need to be quoted. This only happens for the `#` character and only when the value starts with it. Also the quote is note escaped in values. This change completely rewrites the `escape` method of `StoredUserConfig`. It takes care of properly escaping characters that need escaping for the git configuration file format. This fixes #1410
* fix: Fix StoredUserConfig handling null subsectionsFlorian Zschocke2022-03-131-0/+58
| | | | | | | | | | Te `StoredUserConfig` did not handle sections without a subsection. When the subsection did not exist, i.e. was `null`, then the subsection name would be set to the string "null". This is not how the config file format works. It should create a `[SECTIONNAME]` entry instead. This fix handles a `null` subsection correctly, by handling it as a section without a subsection.
* test: Add exploit test for config user serviceFlorian Zschocke2022-03-121-1/+126
| | | | | Add unit tests for exploiting the email address or display name in the config user service by using newlines in the values.
* pages: Fix repo-relative reference links in markdown docsFlorian Zschocke2021-12-061-1/+1
| | | | | | | | As with explicit links, also for reference links in markdown documents which point to repository-relative files the links are broken. They do not take the path to the repository into account. This fix is related to commit b23269 which fixed issue #1358 for explicit links.
* Add tests for MarkupProcessorFlorian Zschocke2021-12-041-0/+734
|
* Add test for loading russian propertiesFlorian Zschocke2021-11-031-0/+10
|
* TimeUtils: Change daysAgo to calculate difference in calendar daysFlorian Zschocke2021-10-241-0/+424
| | | | | | | | | | | | | The `daysAgo` method seemed to want to normalize on a calendar day? I can't really tell what it was trying to do, but the problem is that it does not take into account any time shift due to time zones so it never really worked outside of GMT. So instead a new `calendarDaysAgo` method is added (because I am unsure on what the `daysAgo` method is trying to do. It can probably be removed). The new method cleanly calculates difference in calendar days because it normalizes the two given time stamps on the same time zone. The `timeAgo` method now used the new method. This fixes #1248.
* TimeUtils: Move unit test to same package as TimeUtils isFlorian Zschocke2021-10-232-3/+5
| | | | | | | | | | For some reason the `TimeUtilsTest` class is, like almost all tests, in the `com.gitblit.tests` package. But this way all methods in classes which we might predominately need for tests have to be public. So move the unit test class `TimeUtilsTest` to the same package as the class it is testing, i.e. `com.gitblit.utils.TimeUtils`. This way we ca set the new added methods which get the current time passed in to be at least not public.
* TimeUtils: Increase testability and add testsFlorian Zschocke2021-10-231-0/+157
| | | | | | | | | Add tests for `timeAgo` to analyse issue #1248. The tests are dependent on when they run as they time functions use the current date and time. To make them testable in a reproducible way, we need the ability to pass in what we think is "now". So add overloaded methods that take a `now` parameter so that we can pass in the current time.
* Add a unit test to check if the resource bundle can be loadedFlorian Zschocke2021-10-201-0/+146
| | | | | | | | | To prevent that we have a resource file in a resource bundle broken and not loading undiscovered for years, add a unit test that will load the resource properties file for each of the languages. In order to check if the file was loaded and the bundle mechanism didn't fall back on the default, a new property key is added to each language file, solely for the purpose to be checked in the unit test.
* raw: Fix raw links to branches with a slash in their nameFlorian Zschocke2020-11-101-16/+16
| | | | | | | | | When a branch has a slash in the name, the raw servlet was not able to find the path under that branch. This is due to the replacement of the forward slash character for URLs. It was not taken into account when comparing the branch name later. This fixes #1290 and its duplicates #1234 and #813.
* raw: Refactor RawServlet:getBranch and :getPath parametersFlorian Zschocke2020-11-091-44/+685
| | | | | | | | | | | Refactor the `getBranch` and `getPath` methods to take a String as second parameter, which is the already sanitised path info. Don't get the path info from a passed in request anymore. The methods are only ever called from within `processRequest`, which already does some checks on the path info, like removing a leading slash character. So no need to do that every time again the methods and passing a request for that.
* raw: Fix exceptions when no path info is given to raw servletFlorian Zschocke2020-11-091-1/+111
|
* raw: Strip leading and trailing slash from repo and path names for linkFlorian Zschocke2020-11-092-0/+687
| | | | | | When creating a link for raw display, a trailing slash is stripped from the end of the base URL. Also do this for the repository, as well as stripping leading slashes from the repository and the path values.
* Delete password from memory in AuthenticationManagerFlorian Zschocke2020-04-052-12/+87
| | | | | | Zero out the password to remove it from memory after use. This is only a first step, implementing it for one method: `AuthenticationManager.authenticate(String, char[], String)`.
* 🦟 fix: Password hash upgrade kills existing passwordsFlorian Zschocke2020-04-051-4/+12
| | | | | | | | | | The upgrade of a MD5 stored password hash to a PBKDF password hash destroys the stored password. The has check zeroes out the password that is tested, so that the new hash is built over the zeroed out value. This fix prevents that an also adds a check to the test. Fixes #1335
* Update test file with MD hashed passwordFlorian Zschocke2019-11-111-1/+2
| | | | | | | | | With the feature of passwords getting automatically upgraded to a hashed version, the default `admin` password in the test-users file will get stored as MD5 hashed during test execution. Commit this change, so that the file isn't always showing up as changed.
* Add `clone.bundle` as known command, but reject it as not implemented.Florian Zschocke2019-11-111-1/+13
|
* Fix NPE when no action can be parsed from the URLFlorian Zschocke2019-11-111-0/+54
| | | | | | | | | | | | Renames `static final` variables according to convention to be in all upper case. That makes it easier to see that in an `equals` comparison the final variable should come first as it will not trigger a NPE. Also strip parameters from the URL when extracting the repository name from it. Parameters can not be part of a repository name, and this way an empty repository name can be detected. Fixes #1092
* In SSH tests ignore an external SSH toolFlorian Zschocke2019-11-101-0/+55
| | | | | | | | | | | | | | The SshDaemonTest would fail under Windows. That is because JGit looks at the `GIT_SSH` environment variable. If it is set, the tool the variable is pointing to is used for the SSH connection. This is a problem when it is set to "Plink" under Windows, because Plink will not recognize the server key and will not find it in the registry, cached as a known host. Since a test can/should not add the key to the registry but simply wants to ignore it, but there is no way to tell Plink to do so, the tests would fail. This patch filters the `GIT_SSH` environment variable from JGit's `SystemReader`, so that the internal SSH client is used.
* Update SSHD dependency to version 1.2.0.Florian Zschocke2019-11-101-1/+15
|
* Update SSHD dependency to version 1.1.0.Florian Zschocke2019-11-102-6/+11
|
* Ignore the `RedisTicketService` tests until they are fixed.Florian Zschocke2019-11-101-0/+3
| | | | | Currently the tests cannot run as no Redis is available. Needs to be fixed at some time.
* Merge branch 'pingunaut-1166_more_secure_password_hashes' into master.Florian Zschocke2019-11-062-0/+698
|\
| * Add more PasswordHash tests with strings beyond iso-8859-1.Florian Zschocke2019-11-061-1/+31
| |
| * Use the new PasswordHash classes.Florian Zschocke2019-11-053-69/+72
| | | | | | | | | | | | Integrate the `PasswordHash` class and subclass in the user and password editing and authentication. Replaces the old code and the previous `SecurePasswordHashingUtils` class.
| * Add support for PBKDF2 to PasswordHashFlorian Zschocke2019-11-051-5/+181
| | | | | | | | | | | | | | | | Integrate the work of pingunaut to add support for PBKDF2 password hashing. A new class `PasswordHashPbkdf2` is added, which builds on his `SecurePasswordHashUtils` class, but makes it a subclass of `PasswordHash`. This will replace the original class when integrating the new PasswordHash way into GitBlit.
| * Add a PasswordHash class as a central place to deal with password hashes.Florian Zschocke2019-11-051-0/+420
| | | | | | | | | | | | | | | | | | | | | | | | Instead of having to deal with the implementation details of hashing and verifying passwords in multiple places, have a central unit be responsible for it. Otherwise we need to edit three different places when adding a new hashing scheme. With this class adding a new hashing scheme just requires creating a new subclass of `PasswordHash` and registering its type in the enum `PasswordHash.Type`. The rest of the code will use a common interface for all hashing schemes and doesn't need to be changed when a new one is added.
| * Update AuthenticationManager to update weakly stored passwords on loginMartin Spielmann2017-01-071-0/+6
| |
| * Added possibility to use secure hashes to store passwordsMartin Spielmann2017-01-011-0/+63
| | | | | | | | Addresses #1166
* | Add support nested groups on the Repositories pageFlorian Zschocke2019-06-151-0/+49
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Fix for #725. Also covers #527. This is a squashed commit of the following commits, merging and closing pull request #1267: commit 55fee41769ffab1aff59344fe117d481687aa743 Author: Martin Spielmann <mail@martinspielmann.de> Date: Mon Nov 6 17:19:53 2017 +0100 declared local variable final to fix travis build commit 131e4d14a48c2a3fdce621fa54637de50684d040 Author: Martin Spielmann <mail@martinspielmann.de> Date: Mon Nov 6 14:11:55 2017 +0100 fix formatting (use tab for identation) commit 8da5f6d5967894f157251c320928acdab3a451e7 Author: Martin Spielmann <mail@martinspielmann.de> Date: Mon Nov 6 13:45:39 2017 +0100 Add repositoryListType tree. Addresses #725, 527 and includes #1224 commit 6c061651fb95212ae242dbca06c8d9ef80146201 Merge: f365daa3 40ee9653 Author: Martin Spielmann <mail@martinspielmann.de> Date: Sat Nov 4 13:19:08 2017 +0100 Merge remote-tracking branch 'collapsible/ticket/527' into 725_nested_repos commit f365daa3b1d6be135365f9b11bdece320beabf4e Author: Martin Spielmann <mail@martinspielmann.de> Date: Sat Nov 4 13:10:24 2017 +0100 first working version of tree model
* | Fix revLog test that broke due to changes in the hello-world repository.Florian Zschocke2019-06-102-3/+5
| |
* | Create unit tests for special characters in path namesFlorian Zschocke2019-06-103-3/+19
| | | | | | | | | | | | | | Create a regression test for issue #999. Add directories with '[]' ans '()' in the name to the hello-world repository, so that they can be used in unit tests for repository paths with special characters.
* | Do not resolve symbolic links to repositories.Florian Zschocke2019-06-101-0/+117
| | | | | | | | | | | | | | | | | | | | | | | | | | | | When symbolic links under the base repository folder point to repositories outside the base repository folder, the forming of relative repository names failed and resulted in NullPointerExceptions. Create the relative path by not following symbolic links, i.e. the link name is taken as is and not resolved to the external path. This also changes the whole `exactPath` method to work on Paths, instead of Files. Fixes #891 and fixes #837.
* | Zips of recreated hello-world.git and all external repositories for testing.chirontt2019-06-0712-46/+142
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This hello-world.git repo is created using the native Git for Windows software. Various test classes in the GitBlitSuite test suite require the presence of the hello-world.git repo in github.com/git/ which has been missing, hence causing many test failures in the suite. This recreation of the hello-world.git repo aims to conform to the many test cases' requirements in the suite, and to be checked in as part of the gitblit repo, thus eliminates the requirement of a remote hello-world.git repo during the test run. The repo is now stored is a zip ball in the new src/test/data folder. The hello-world repo's various commit IDs were hard-coded in various test classes. These commit IDs, which must now have new values in the recreated repo, are now extracted out to the src/test/data/hello-world.properties file. The gitblit's build.xml is modified to generate the HelloworldKeys.java file containing the hello-world.properties file's key strings, in similar fashion as the existing generation of the com.gitblit.Keys.java file. And these key strings in HelloworldKeys.java are now used in the various test classes, thus eliminating the hard-coding of the hello-world repo's commit IDs in the test code. During the test run by GitBlitSuite test suite, some repos from GitHub were cloned and became part of the test data. These repos are now zipped to be part of gitblit repo itself, thus eliminating the network fetch at the start of test run which can be slow, especially with the JGit repo cloning which is huge and time consuming. The cloned JGit repo is now zipped and checked in to gitblit, along with the other 4 repos (hello-world, ambition, gitective and ticgit). They will be unzipped during the test suite run and be available in the local file system, thus avoiding the need for some network fetch. Special note on the zipped JGit repo: this repo is big (and growing all the time on GitHub), and takes up about 32MB of disk space after cloning from GitHub. I've made it smaller by resetting HEAD back to a commit of 5 years ago (with git reset --hard <commitId> command), to put it back to roughly where/when the tests were written for it (which is not quite, because there are tons of commit history since which can't be removed.) The local JGit repo is then garbage-collected (with git gc --prune --aggressive) to reduce its size to about 19MB. Zipped it is still 17MB. This is a lot of MBs for a few tests. So the JGit repo is not included in this commit. Fixes #1275
* | Fix for various test failures.chirontt2019-06-079-90/+112
| | | | | | | | | | | | | | | | | | | | | | | | Most of failures were due to temporary test repos, users and/or teams being left behind after the test run, and these left-over stuff in $baseFolder/data/git caused assertion errors in many tests in subsequent test runs. This fix tries to delete those left-over stuff at the end of each test, mainly in their @Afterclass code blocks. PushLogTest.java is deleted as it doesn't work, and has been superseded with better tests in various protocol test suites (GitServletTest, GitDaemonTest, SshDaemonTest, etc.)
* | Reindex tickets on server start if no index existsFlorian Zschocke2017-03-054-4/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Check if tickets need to be reindexed when the server starts. This is the case if no ticket index exists. In that case the ticket index is built. This is done during the start of the `ITicketService`. For this the interface of `ITicketService` needed to change. The `start` method was defined abstract and the specific ticket services had to implement it. None does any real starting stuff in it. The `start` method is now final. It calls a new abstract method `onStart` which the specific ticket services need to implement. In the existing implementations I just changed `start` to `onStart`.
* | Use versioned index directories for repository indices.Florian Zschocke2017-03-051-0/+267
| | | | | | | | | | | | | | | | | | | | | | | | | | Change from the index version of a repository index being stored in a config file to also using index directories with the version in the name. For that, `LuceneRepoIndexStore` is added, which adds the fixed `lucene` part to the path. It also gives out the location of the `lucene.conf` file, which is now stored in the index directory. This way it is automatically deleted when the directory is deleted. I believe that it should also provide means to store branch aliases and tips, i.e. hide the config file completely. But this isn't implemented with this commit, the `LuceneService` is still aware that a config file is used.
* | Introduce an index version for the ticket indexFlorian Zschocke2017-03-051-0/+245
|/ | | | | | | | | | | | | | | | | In order to be able to update the index definition, the ticket index is assigned a version number, 2. This way the definiton can be updated and compatability with existing index files can be checked. The actual index is stored in a directory of name `indexVersion_codecVersion`. This wayit is veriy easy to check if an index of a certain version exists on the filesystem. It allows to have multiple indexes of different versions present, so that a downgrade of the software is possible without having to reindex again. Of coure, this is only possible if no new tickets were created since these would be missing in the old index. A new class `LuceneIndexStore` is introduced, which abstracts away the versioned index directory. The idea is, that this provides one place to keep the Lucene codec version and to allow to code compatibility rules into this class, so that older indices can still be used if they are compatible.
* Merge pull request #1160 from fzs/sshLdapAuthenticatorFlorian Zschocke2016-12-185-339/+1427
|\ | | | | LDAP SSH key manager
| * Fix SshKeysDispatcher test failing on WindowsFlorian Zschocke2016-12-061-7/+7
| | | | | | | | | | | | | | | | | | The `SshKeysDispatcher` tests that use the keys list command are failing on Windows because they assume a Unix line ending after each key. But the command will use a system line ending. So this fix uses system line endings in the reference string for the assert, too. In addition, two `assertTrue(false)´ are replaced with a proper `fail`.
generated by cgit v1.2.3 (git 2.39.1) at 2025-01-09 00:04:30 +0000