mirrors/forgejo
1
0
Fork 0
mirror of https://codeberg.org/forgejo/forgejo.git synced 2025-08-27 04:33:50 +00:00
Code Issues Projects Releases Packages Wiki Activity

[v12.0/forgejo] fix: follow symlinks for local assets (#8610)

Browse source 
**Backport:** https://codeberg.org/forgejo/forgejo/pulls/8596

- This reverts behavior that was partially unintentionally introduced in forgejo/forgejo#8143, symbolic links were no longer followed (if they escaped the asset folder) for local assets.
- Having symbolic links for user-added files is, to my understanding, a ,common usecase for NixOS and would thus have symbolic links in the asset folders. Avoiding symbolic links is not easy.
- The previous code used `http.Dir`, we cannot use that as it's not of the same type. The equivalent is `os.DirFS`.
- Unit test to prevent this regression from happening again.

Reported-by: bloxx12 (Matrix).
Co-authored-by: Gusted <postmaster@gusted.xyz>
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/8610
Reviewed-by: Gusted <gusted@noreply.codeberg.org>
Co-authored-by: forgejo-backport-action <forgejo-backport-action@noreply.codeberg.org>
Co-committed-by: forgejo-backport-action <forgejo-backport-action@noreply.codeberg.org>
This commit is contained in:
forgejo-backport-action 2025-07-22 18:41:03 +02:00 • committed by Gusted
commit 4819d4a29a
2 changed files with 30 additions and 9 deletions
Download patch file Download diff file Expand all files Collapse all files

28
modules/assetfs/layered_test.go
View file

@ -1,4 +1,5 @@
// Copyright 2023 The Gitea Authors. All rights reserved.
// Copyright 2025 The Forgejo Authors. All rights reserved.
// SPDX-License-Identifier: MIT
package assetfs
@ -108,3 +109,30 @@ func TestLayered(t *testing.T) {
assert.Equal(t, "l1", assets.GetFileLayerName("f1"))
assert.Equal(t, "l2", assets.GetFileLayerName("f2"))
}
// Allow layers to read symlink outside the layer root.
func TestLayeredSymlink(t *testing.T) {
dir := t.TempDir()
dirl1 := filepath.Join(dir, "l1")
require.NoError(t, os.MkdirAll(dirl1, 0o755))
// Open layer in dir/l1
layer := Local("l1", dirl1)
// Create a file in dir/outside
fileContents := []byte("I am outside the layer")
require.NoError(t, os.WriteFile(filepath.Join(dir, "outside"), fileContents, 0o600))
// Symlink dir/l1/outside to dir/outside
require.NoError(t, os.Symlink(filepath.Join(dir, "outside"), filepath.Join(dirl1, "outside")))
// Open dir/l1/outside.
f, err := layer.Open("outside")
require.NoError(t, err)
defer f.Close()
// Confirm it contains the output of dir/outside
contents, err := io.ReadAll(f)
require.NoError(t, err)
assert.Equal(t, fileContents, contents)
}