8c8f3ab4b3
CI / test (pull_request) Successful in 18s
CI / review (anthropic--claude-4.6-sonnet, sonnet, SONNET_REVIEW_TOKEN) (pull_request) Successful in 44s
CI / review (gpt-5, security, ., rodin/security-patterns, SECURITY_REVIEW.md, SECURITY_REVIEW_TOKEN) (pull_request) Successful in 1m57s
CI / review (gpt-5, gpt, GPT_REVIEW_TOKEN) (pull_request) Successful in 2m21s
## Changes ### Go: IP-level SSRF protection in gitea.Client (primary defense) - Add gitea/ipcheck.go with IsBlockedIP() covering all blocked CIDR ranges: loopback (127.0.0.0/8, ::1), RFC1918 (10/8, 172.16/12, 192.168/16), link-local (169.254/16, fe80::/10), ULA (fc00::/7), CGN (100.64/10), multicast, reserved, and unspecified ranges. - IPv6-mapped IPv4 addresses (::ffff:x.x.x.x) are normalized before checking. - Add safeDialContext to gitea.Client: resolves DNS, rejects any IP in a blocked CIDR, then dials the resolved IP directly to narrow the DNS rebinding window. NewClient now uses this safe transport by default. - Add WithUnsafeDialer() for test code using httptest.Server (127.0.0.1). - Update NewTestClient helper in export_test.go for all gitea unit tests. - Update SetHTTPClient(nil) to restore the safe transport (not the plain one). ### Go: validate-url subcommand (defense-in-depth for future bash callers) - Add 'review-bot validate-url <url>' subcommand: validates https scheme, no user-info, resolves hostname, rejects any blocked IP. - Exit 0=safe, 1=blocked, 2=validation error/dns failure. - Add outWriter/errWriter vars to main.go for testable output capture. ### action.yml: Python3 IP check in 'Determine version' step - After the https scheme validation, resolve SERVER_URL hostname with socket.getaddrinfo and reject any result where ipaddress.ip_address(ip).is_private/is_loopback/is_link_local/etc. is true. - python3 is required on ubuntu-* runners (noted in existing comments). - Covers the version-check curl that sends ACTION_TOKEN to SERVER_URL. - SERVER_URL for install-step curls is covered by the same pre-check. ### Tests - gitea/ipcheck_test.go: 30+ cases covering all blocked families + public IPs - gitea/client_test.go: safe transport presence, WithUnsafeDialer, SSRF blocking - cmd/review-bot/validateurl_test.go: scheme validation, user-info, exit codes Closes #123
98 lines
2.3 KiB
Go
98 lines
2.3 KiB
Go
package gitea
|
|
|
|
import (
|
|
"context"
|
|
"errors"
|
|
"math"
|
|
"net/http"
|
|
"net/http/httptest"
|
|
"strings"
|
|
"testing"
|
|
"time"
|
|
)
|
|
|
|
func TestGetPullRequestDiff_SizeLimits(t *testing.T) {
|
|
tests := []struct {
|
|
name string
|
|
diff string
|
|
maxDiffSize int64
|
|
wantErr error
|
|
wantDiff string
|
|
}{
|
|
{
|
|
name: "exceeds max size",
|
|
diff: strings.Repeat("+ added line\n", 1000), // ~13 KB
|
|
maxDiffSize: 100,
|
|
wantErr: ErrDiffTooLarge,
|
|
},
|
|
{
|
|
name: "within max size",
|
|
diff: "diff --git a/f.go b/f.go\n--- a/f.go\n+++ b/f.go\n@@ -1 +1 @@\n-old\n+new\n",
|
|
maxDiffSize: 1024,
|
|
wantDiff: "diff --git a/f.go b/f.go\n--- a/f.go\n+++ b/f.go\n@@ -1 +1 @@\n-old\n+new\n",
|
|
},
|
|
{
|
|
name: "exactly at limit",
|
|
diff: strings.Repeat("x", 50),
|
|
maxDiffSize: 50,
|
|
wantDiff: strings.Repeat("x", 50),
|
|
},
|
|
{
|
|
name: "one byte over limit",
|
|
diff: strings.Repeat("x", 51),
|
|
maxDiffSize: 50,
|
|
wantErr: ErrDiffTooLarge,
|
|
},
|
|
{
|
|
name: "disabled limit",
|
|
diff: strings.Repeat("x", 10000),
|
|
maxDiffSize: -1,
|
|
wantDiff: strings.Repeat("x", 10000),
|
|
},
|
|
{
|
|
name: "math.MaxInt64 treated as disabled",
|
|
diff: strings.Repeat("x", 10000),
|
|
maxDiffSize: math.MaxInt64,
|
|
wantDiff: strings.Repeat("x", 10000),
|
|
},
|
|
{
|
|
name: "default limit",
|
|
diff: "diff content",
|
|
maxDiffSize: 0, // zero means use DefaultMaxDiffSize
|
|
wantDiff: "diff content",
|
|
},
|
|
}
|
|
|
|
for _, tt := range tests {
|
|
t.Run(tt.name, func(t *testing.T) {
|
|
server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
|
w.Write([]byte(tt.diff)) //nolint:errcheck // test handler
|
|
}))
|
|
defer server.Close()
|
|
|
|
client := NewTestClient(server.URL, "test-token")
|
|
client.MaxDiffSize = tt.maxDiffSize
|
|
client.RetryBackoff = []time.Duration{}
|
|
|
|
got, err := client.GetPullRequestDiff(context.Background(), "owner", "repo", 1)
|
|
|
|
if tt.wantErr != nil {
|
|
if err == nil {
|
|
t.Fatal("expected error, got nil")
|
|
}
|
|
if !errors.Is(err, tt.wantErr) {
|
|
t.Errorf("expected %v, got: %v", tt.wantErr, err)
|
|
}
|
|
return
|
|
}
|
|
|
|
if err != nil {
|
|
t.Fatalf("unexpected error: %v", err)
|
|
}
|
|
if got != tt.wantDiff {
|
|
t.Errorf("diff mismatch: got length %d, want length %d", len(got), len(tt.wantDiff))
|
|
}
|
|
})
|
|
}
|
|
}
|