mirror of
https://gitea.com/gitea/tea.git
synced 2026-10-26 11:01:25 +01:00
bircni
ab6228e25b
run logs and api copied server bytes straight to stdout. CI logs are attacker-influenced through pull request workflows, so they could drive the terminal of whoever read them. On a terminal, run logs now keep only SGR color sequences, job names are reduced to plain text, and api drops control characters from the response. Piped output and --output-file stay byte-exact. Signed-off-by: bircni <bircni@icloud.com>
94 lines
3.5 KiB
Go
94 lines
3.5 KiB
Go
// Copyright 2026 The Gitea Authors. All rights reserved.
|
|
// SPDX-License-Identifier: MIT
|
|
|
|
package app
|
|
|
|
import (
|
|
"context"
|
|
"net/http"
|
|
"os"
|
|
"path/filepath"
|
|
"testing"
|
|
|
|
"github.com/stretchr/testify/require"
|
|
)
|
|
|
|
func TestRunLogsStreamWithoutMixingDiagnosticsAndVerifyJobMembership(t *testing.T) {
|
|
downloads := 0
|
|
server := newAuthenticatedServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
|
require.Equal(t, http.MethodGet, r.Method)
|
|
switch r.URL.Path {
|
|
case "/api/v1/repos/owner/repo/actions/runs/7/jobs":
|
|
if r.URL.Query().Get("page") == "1" {
|
|
_, _ = w.Write([]byte(`{"jobs":[{"id":9,"name":"Build"}]}`))
|
|
} else {
|
|
_, _ = w.Write([]byte(`{"jobs":[]}`))
|
|
}
|
|
case "/api/v1/repos/owner/repo/actions/runs/7/logs":
|
|
_, _ = w.Write([]byte("ZIP archive bytes"))
|
|
case "/api/v1/repos/owner/repo/actions/jobs/9/logs":
|
|
downloads++
|
|
_, _ = w.Write([]byte("exact log\n"))
|
|
default:
|
|
t.Errorf("unexpected endpoint %s", r.URL.Path)
|
|
w.WriteHeader(404)
|
|
}
|
|
}))
|
|
defer server.Close()
|
|
deps, out, diagnostics := serverDeps(t, server.URL)
|
|
args := []string{"run", "logs", "7", "-R", "owner/repo", "--job=9", "--no-input"}
|
|
require.NoError(t, Execute(context.Background(), deps, args))
|
|
require.Equal(t, "exact log\n", out.String())
|
|
require.Equal(t, "Job 9: Build\n", diagnostics.String())
|
|
require.Equal(t, 1, downloads)
|
|
out.Reset()
|
|
diagnostics.Reset()
|
|
require.NoError(t, Execute(context.Background(), deps, []string{"run", "jobs", "7", "-R", "owner/repo", "--limit=20", "--page=1", "--json=id,name,run_attempt"}))
|
|
require.JSONEq(t, `[{"id":9,"name":"Build","run_attempt":0}]`, out.String())
|
|
require.Empty(t, diagnostics.String())
|
|
out.Reset()
|
|
require.NoError(t, Execute(context.Background(), deps, []string{"run", "jobs", "7", "-R", "owner/repo", "--page=2", "--json"}))
|
|
require.JSONEq(t, `[]`, out.String())
|
|
out.Reset()
|
|
diagnostics.Reset()
|
|
args[5] = "--job=10"
|
|
err := Execute(context.Background(), deps, args)
|
|
require.ErrorContains(t, err, "does not belong")
|
|
require.Equal(t, 1, downloads)
|
|
require.Empty(t, out.String())
|
|
path := filepath.Join(t.TempDir(), "logs.zip")
|
|
require.NoError(t, Execute(context.Background(), deps, []string{"run", "logs", "7", "-R", "owner/repo", "--output-file", path}))
|
|
data, err := os.ReadFile(path)
|
|
require.NoError(t, err)
|
|
require.Equal(t, "ZIP archive bytes", string(data))
|
|
require.Empty(t, out.String())
|
|
require.Empty(t, diagnostics.String())
|
|
}
|
|
|
|
func TestRunLogsKeepOnlyColorsOnATerminal(t *testing.T) {
|
|
const logs = "\x1b[36mstep\x1b[0m \x1b]0;PWNED\x07done\x1b[2J\r\n"
|
|
server := newAuthenticatedServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
|
switch r.URL.Path {
|
|
case "/api/v1/repos/owner/repo/actions/runs/7/jobs":
|
|
if r.URL.Query().Get("page") == "1" {
|
|
_, _ = w.Write([]byte(`{"jobs":[{"id":9,"name":"Build\u001b]0;PWNED\u0007"}]}`))
|
|
} else {
|
|
_, _ = w.Write([]byte(`{"jobs":[]}`))
|
|
}
|
|
case "/api/v1/repos/owner/repo/actions/jobs/9/logs":
|
|
_, _ = w.Write([]byte(logs))
|
|
default:
|
|
t.Errorf("unexpected endpoint %s", r.URL.Path)
|
|
w.WriteHeader(http.StatusNotFound)
|
|
}
|
|
}))
|
|
defer server.Close()
|
|
for tty, want := range map[bool]string{false: logs, true: "\x1b[36mstep\x1b[0m ]0;PWNEDdone[2J\n"} {
|
|
deps, out, diagnostics := serverDeps(t, server.URL)
|
|
deps.Streams.OutTTY = tty
|
|
require.NoError(t, Execute(context.Background(), deps, []string{"run", "logs", "7", "-R", "owner/repo", "--job=9", "--no-input"}))
|
|
require.Equal(t, want, out.String(), "tty=%t", tty)
|
|
require.Equal(t, "Job 9: Build]0;PWNED\n", diagnostics.String())
|
|
}
|
|
}
|