diff options
| author | zeripath <art27@cantab.net> | 2022-09-04 11:47:56 +0100 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2022-09-04 13:47:56 +0300 |
| commit | e6b3be460840f1f982d5358198466e7d6f509d21 (patch) | |
| tree | d3e4cb52c6a7df321e9b4ffdfe6f99f79d392b63 /modules/migration/release.go | |
| parent | 93a610a819688b54d4565b8cbbae7cc04c552073 (diff) | |
| download | gitea-e6b3be460840f1f982d5358198466e7d6f509d21.tar.gz gitea-e6b3be460840f1f982d5358198466e7d6f509d21.zip | |
Add more checks in migration code (#21011)
When migrating add several more important sanity checks:
* SHAs must be SHAs
* Refs must be valid Refs
* URLs must be reasonable
Signed-off-by: Andrew Thornton <art27@cantab.net>
Signed-off-by: Andrew Thornton <art27@cantab.net>
Co-authored-by: techknowlogick <matti@mdranta.net>
Diffstat (limited to 'modules/migration/release.go')
| -rw-r--r-- | modules/migration/release.go | 9 |
1 files changed, 5 insertions, 4 deletions
diff --git a/modules/migration/release.go b/modules/migration/release.go index cbdf01a3ed..923b3817b0 100644 --- a/modules/migration/release.go +++ b/modules/migration/release.go @@ -18,15 +18,16 @@ type ReleaseAsset struct { DownloadCount *int `yaml:"download_count"` Created time.Time Updated time.Time - DownloadURL *string `yaml:"download_url"` + + DownloadURL *string `yaml:"download_url"` // SECURITY: It is the responsibility of downloader to make sure this is safe // if DownloadURL is nil, the function should be invoked - DownloadFunc func() (io.ReadCloser, error) `yaml:"-"` + DownloadFunc func() (io.ReadCloser, error) `yaml:"-"` // SECURITY: It is the responsibility of downloader to make sure this is safe } // Release represents a release type Release struct { - TagName string `yaml:"tag_name"` - TargetCommitish string `yaml:"target_commitish"` + TagName string `yaml:"tag_name"` // SECURITY: This must pass git.IsValidRefPattern + TargetCommitish string `yaml:"target_commitish"` // SECURITY: This must pass git.IsValidRefPattern Name string Body string Draft bool |