Skip to content

Commit 540541c

Browse files
lunnywxiaoguangzeripath
authored
Hide sensitive content on admin panel progress monitor (go-gitea#19218 & go-gitea#19226) (go-gitea#19231)
* Hide sensitive content on admin panel progress monitor (go-gitea#19218) Sanitize urls within git process descriptions. Co-authored-by: wxiaoguang <wxiaoguang@gmail.com> Co-authored-by: Andrew Thornton <art27@cantab.net> * Do not include global arguments in process manager (go-gitea#19226) Backport go-gitea#19226 The git command by default adds a number of global arguments. These are not helpful to be displayed in the process manager and so should be skipped for default process descriptions. Signed-off-by: Andrew Thornton <art27@cantab.net> Co-authored-by: wxiaoguang <wxiaoguang@gmail.com> Co-authored-by: Andrew Thornton <art27@cantab.net>
1 parent a13d64b commit 540541c

File tree

4 files changed

+61
-13
lines changed

4 files changed

+61
-13
lines changed

‎modules/git/command.go‎

Lines changed: 25 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,7 @@ import (
1717

1818
"code.gitea.io/gitea/modules/log"
1919
"code.gitea.io/gitea/modules/process"
20+
"code.gitea.io/gitea/modules/util"
2021
)
2122

2223
var (
@@ -32,10 +33,11 @@ const DefaultLocale = "C"
3233

3334
// Command represents a command with its subcommands or arguments.
3435
type Command struct {
35-
name string
36-
args []string
37-
parentContext context.Context
38-
desc string
36+
name string
37+
args []string
38+
parentContext context.Context
39+
desc string
40+
globalArgsLength int
3941
}
4042

4143
func (c *Command) String() string {
@@ -56,9 +58,10 @@ func NewCommandContext(ctx context.Context, args ...string) *Command {
5658
cargs := make([]string, len(GlobalCommandArgs))
5759
copy(cargs, GlobalCommandArgs)
5860
return &Command{
59-
name: GitExecutable,
60-
args: append(cargs, args...),
61-
parentContext: ctx,
61+
name: GitExecutable,
62+
args: append(cargs, args...),
63+
parentContext: ctx,
64+
globalArgsLength: len(GlobalCommandArgs),
6265
}
6366
}
6467

@@ -145,7 +148,21 @@ func (c *Command) RunWithContext(rc *RunContext) error {
145148

146149
desc := c.desc
147150
if desc == "" {
148-
desc = fmt.Sprintf("%s %s [repo_path: %s]", c.name, strings.Join(c.args, " "), rc.Dir)
151+
args := c.args[c.globalArgsLength:]
152+
var argSensitiveURLIndexes []int
153+
for i, arg := range c.args {
154+
if strings.Contains(arg, "://") && strings.Contains(arg, "@") {
155+
argSensitiveURLIndexes = append(argSensitiveURLIndexes, i)
156+
}
157+
}
158+
if len(argSensitiveURLIndexes) > 0 {
159+
args = make([]string, len(c.args))
160+
copy(args, c.args)
161+
for _, urlArgIndex := range argSensitiveURLIndexes {
162+
args[urlArgIndex] = util.NewStringURLSanitizer(args[urlArgIndex], true).Replace(args[urlArgIndex])
163+
}
164+
}
165+
desc = fmt.Sprintf("%s %s [repo_path: %s]", c.name, strings.Join(args, " "), rc.Dir)
149166
}
150167

151168
ctx, cancel, finished := process.GetManager().AddContextTimeout(c.parentContext, rc.Timeout, desc)

‎modules/git/repo.go‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,7 @@ import (
1919
"time"
2020

2121
"code.gitea.io/gitea/modules/proxy"
22+
"code.gitea.io/gitea/modules/util"
2223
)
2324

2425
// GPGSettings represents the default GPG settings for this repository
@@ -158,6 +159,12 @@ func CloneWithArgs(ctx context.Context, from, to string, args []string, opts Clo
158159
}
159160
cmd.AddArguments("--", from, to)
160161

162+
if strings.Contains(from, "://") && strings.Contains(from, "@") {
163+
cmd.SetDescription(fmt.Sprintf("clone branch %s from %s to %s (shared: %t, mirror: %t, depth: %d)", opts.Branch, util.NewStringURLSanitizer(from, true).Replace(from), to, opts.Shared, opts.Mirror, opts.Depth))
164+
} else {
165+
cmd.SetDescription(fmt.Sprintf("clone branch %s from %s to %s (shared: %t, mirror: %t, depth: %d)", opts.Branch, from, to, opts.Shared, opts.Mirror, opts.Depth))
166+
}
167+
161168
if opts.Timeout <= 0 {
162169
opts.Timeout = -1
163170
}
@@ -234,6 +241,11 @@ func Push(ctx context.Context, repoPath string, opts PushOptions) error {
234241
if len(opts.Branch) > 0 {
235242
cmd.AddArguments(opts.Branch)
236243
}
244+
if strings.Contains(opts.Remote, "://") && strings.Contains(opts.Remote, "@") {
245+
cmd.SetDescription(fmt.Sprintf("push branch %s to %s (force: %t, mirror: %t)", opts.Branch, util.NewStringURLSanitizer(opts.Remote, true).Replace(opts.Remote), opts.Force, opts.Mirror))
246+
} else {
247+
cmd.SetDescription(fmt.Sprintf("push branch %s to %s (force: %t, mirror: %t)", opts.Branch, opts.Remote, opts.Force, opts.Mirror))
248+
}
237249
var outbuf, errbuf strings.Builder
238250

239251
if opts.Timeout == 0 {

‎services/mirror/mirror_pull.go‎

Lines changed: 16 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -39,7 +39,13 @@ func UpdateAddress(m *repo_model.Mirror, addr string) error {
3939
return err
4040
}
4141

42-
_, err = git.NewCommand("remote", "add", remoteName, "--mirror=fetch", addr).RunInDir(repoPath)
42+
cmd := git.NewCommand("remote", "add", remoteName, "--mirror=fetch", addr)
43+
if strings.Contains(addr, "://") && strings.Contains(addr, "@") {
44+
cmd.SetDescription(fmt.Sprintf("remote add %s --mirror=fetch %s [repo_path: %s]", remoteName, util.NewStringURLSanitizer(addr, true).Replace(addr), repoPath))
45+
} else {
46+
cmd.SetDescription(fmt.Sprintf("remote add %s --mirror=fetch %s [repo_path: %s]", remoteName, addr, repoPath))
47+
}
48+
_, err = cmd.RunInDir(repoPath)
4349
if err != nil && !strings.HasPrefix(err.Error(), "exit status 128 - fatal: No such remote ") {
4450
return err
4551
}
@@ -53,7 +59,13 @@ func UpdateAddress(m *repo_model.Mirror, addr string) error {
5359
return err
5460
}
5561

56-
_, err = git.NewCommand("remote", "add", remoteName, "--mirror=fetch", wikiRemotePath).RunInDir(wikiPath)
62+
cmd = git.NewCommand("remote", "add", remoteName, "--mirror=fetch", wikiRemotePath)
63+
if strings.Contains(wikiRemotePath, "://") && strings.Contains(wikiRemotePath, "@") {
64+
cmd.SetDescription(fmt.Sprintf("remote add %s --mirror=fetch %s [repo_path: %s]", remoteName, util.NewStringURLSanitizer(wikiRemotePath, true).Replace(wikiRemotePath), wikiPath))
65+
} else {
66+
cmd.SetDescription(fmt.Sprintf("remote add %s --mirror=fetch %s [repo_path: %s]", remoteName, wikiRemotePath, wikiPath))
67+
}
68+
_, err = cmd.RunInDir(wikiPath)
5769
if err != nil && !strings.HasPrefix(err.Error(), "exit status 128 - fatal: No such remote ") {
5870
return err
5971
}
@@ -150,8 +162,8 @@ func pruneBrokenReferences(ctx context.Context,
150162
timeout time.Duration,
151163
stdoutBuilder, stderrBuilder *strings.Builder,
152164
sanitizer *strings.Replacer,
153-
isWiki bool) error {
154-
165+
isWiki bool,
166+
) error {
155167
wiki := ""
156168
if isWiki {
157169
wiki = "Wiki "

‎services/mirror/mirror_push.go‎

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,7 @@ import (
1010
"fmt"
1111
"io"
1212
"regexp"
13+
"strings"
1314
"time"
1415

1516
repo_model "code.gitea.io/gitea/models/repo"
@@ -28,7 +29,13 @@ var stripExitStatus = regexp.MustCompile(`exit status \d+ - `)
2829
// AddPushMirrorRemote registers the push mirror remote.
2930
func AddPushMirrorRemote(m *repo_model.PushMirror, addr string) error {
3031
addRemoteAndConfig := func(addr, path string) error {
31-
if _, err := git.NewCommand("remote", "add", "--mirror=push", m.RemoteName, addr).RunInDir(path); err != nil {
32+
cmd := git.NewCommand("remote", "add", "--mirror=push", m.RemoteName, addr)
33+
if strings.Contains(addr, "://") && strings.Contains(addr, "@") {
34+
cmd.SetDescription(fmt.Sprintf("remote add %s --mirror=push %s [repo_path: %s]", m.RemoteName, util.NewStringURLSanitizer(addr, true).Replace(addr), path))
35+
} else {
36+
cmd.SetDescription(fmt.Sprintf("remote add %s --mirror=push %s [repo_path: %s]", m.RemoteName, addr, path))
37+
}
38+
if _, err := cmd.RunInDir(path); err != nil {
3239
return err
3340
}
3441
if _, err := git.NewCommand("config", "--add", "remote."+m.RemoteName+".push", "+refs/heads/*:refs/heads/*").RunInDir(path); err != nil {

0 commit comments

Comments
 (0)