diff options
| author | zeripath <art27@cantab.net> | 2021-08-12 23:22:05 +0100 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2021-08-13 00:22:05 +0200 |
| commit | 5fbccad906f803c63e758ad3a168714430c9d1a9 (patch) | |
| tree | ca59e5ea2db5f999b8ba6397206da83b985fc613 /modules | |
| parent | 2289580bb7ef8dfa4124c2b3bfb89897dbb35f46 (diff) | |
| download | gitea-5fbccad906f803c63e758ad3a168714430c9d1a9.tar.gz gitea-5fbccad906f803c63e758ad3a168714430c9d1a9.zip | |
Fix NPE in fuzzer (#16680)
The fuzzer found an issue with the issue pattern processor where there is a spurious
path.Clean which does not need to be there. This PR also sets the default AppURL for
the fuzzer too.
Signed-off-by: Andrew Thornton <art27@cantab.net>
Diffstat (limited to 'modules')
| -rw-r--r-- | modules/markup/html.go | 2 | ||||
| -rw-r--r-- | modules/markup/html_test.go | 16 |
2 files changed, 17 insertions, 1 deletions
diff --git a/modules/markup/html.go b/modules/markup/html.go index 5ddd478ed6..f279e23bff 100644 --- a/modules/markup/html.go +++ b/modules/markup/html.go @@ -781,7 +781,7 @@ func fullIssuePatternProcessor(ctx *RenderContext, node *html.Node) { // extract repo and org name from matched link like // http://localhost:3000/gituser/myrepo/issues/1 - linkParts := strings.Split(path.Clean(link), "/") + linkParts := strings.Split(link, "/") matchOrg := linkParts[len(linkParts)-4] matchRepo := linkParts[len(linkParts)-3] diff --git a/modules/markup/html_test.go b/modules/markup/html_test.go index dff9102bed..3eb2df00a9 100644 --- a/modules/markup/html_test.go +++ b/modules/markup/html_test.go @@ -5,6 +5,7 @@ package markup_test import ( + "io" "strings" "testing" @@ -526,3 +527,18 @@ func BenchmarkEmojiPostprocess(b *testing.B) { assert.NoError(b, err) } } + +func TestFuzz(t *testing.T) { + s := "t/l/issues/8#/../../a" + renderContext := RenderContext{ + URLPrefix: "https://example.com/go-gitea/gitea", + Metas: map[string]string{ + "user": "go-gitea", + "repo": "gitea", + }, + } + + err := PostProcess(&renderContext, strings.NewReader(s), io.Discard) + + assert.NoError(t, err) +} |