forgejo/routers/web/repo
Gusted 5b3a82d621
[FEAT] Enable ambiguous character detection in configured contexts
- The ambiguous character detection is an important security feature to
combat against sourcebase attacks (https://trojansource.codes/).
- However there are a few problems with the feature as it stands
today (i) it's apparantly an big performance hitter, it's twice as slow
as syntax highlighting (ii) it contains false positives, because it's
reporting valid problems but not valid within the context of a
programming language (ambiguous charachters in code comments being a
prime example) that can lead to security issues (iii) charachters from
certain languages always being marked as ambiguous. It's a lot of effort
to fix the aforementioned issues.
- Therefore, make it configurable in which context the ambiguous
character detection should be run, this avoids running detection in all
contexts such as file views, but still enable it in commits and pull
requests diffs where it matters the most. Ideally this also becomes an
per-repository setting, but the code architecture doesn't allow for a
clean implementation of that.
- Adds unit test.
- Adds integration tests to ensure that the contexts and instance-wide
is respected (and that ambigious charachter detection actually work in
different places).
- Ref: https://codeberg.org/forgejo/forgejo/pulls/2395#issuecomment-1575547
- Ref: https://codeberg.org/forgejo/forgejo/issues/564
2024-02-23 13:12:17 +01:00
..
actions Refactor locale&string&template related code (#29165) 2024-02-16 15:20:52 +01:00
badges [GITEA] Add support for shields.io-based badges 2024-02-05 16:09:42 +01:00
flags [FEAT] Repository flags 2024-02-05 16:09:42 +01:00
setting [FEAT] Enable ambiguous character detection in configured contexts 2024-02-23 13:12:17 +01:00
activity.go Implement contributors graph (#27882) 2024-02-17 23:24:31 +01:00
attachment.go Even more db.DefaultContext refactor (#27352) 2023-10-03 10:30:41 +00:00
blame.go [FEAT] Enable ambiguous character detection in configured contexts 2024-02-23 13:12:17 +01:00
branch.go Adjust object format interface (#28469) 2023-12-17 11:56:08 +00:00
cherry_pick.go Refactor locale&string&template related code (#29165) 2024-02-16 15:20:52 +01:00
commit.go [GITEA] Detect file rename and show in history 2024-02-05 16:09:40 +01:00
compare.go Refactor locale&string&template related code (#29165) 2024-02-16 15:20:52 +01:00
contributors.go Deduplicate translations for contributors graph (#29256) 2024-02-19 22:58:33 +01:00
download.go Less naked returns (#25713) 2023-07-07 05:31:56 +00:00
editor.go Refactor locale&string&template related code (#29165) 2024-02-16 15:20:52 +01:00
editor_test.go Simplify how git repositories are opened (#28937) 2024-01-27 21:09:51 +01:00
find.go Implement FSFE REUSE for golang files (#21840) 2022-11-27 18:20:29 +00:00
githttp.go Some refactor for git http (#28995) 2024-01-31 15:23:22 +00:00
githttp_test.go Fix http protocol auth (#27875) 2023-11-02 22:14:33 +08:00
helper.go Improve tree not found page (#26570) 2023-09-29 07:42:39 +00:00
helper_test.go Make web context initialize correctly for different cases (#26726) 2023-08-25 19:07:42 +08:00
issue.go [BUG] Fix pull request reopen conditions 2024-02-17 15:38:16 +01:00
issue_content_history.go Refactor locale&string&template related code (#29165) 2024-02-16 15:20:52 +01:00
issue_dependency.go Upgrade to golangci-lint@v1.55.0 (#27756) 2023-10-24 02:54:59 +00:00
issue_label.go Even more db.DefaultContext refactor (#27352) 2023-10-03 10:30:41 +00:00
issue_label_test.go Refactor locale&string&template related code (#29165) 2024-02-16 15:20:52 +01:00
issue_lock.go Penultimate round of db.DefaultContext refactor (#27414) 2023-10-11 04:24:07 +00:00
issue_pin.go Fix missing check (#28406) 2023-12-10 21:37:10 +02:00
issue_stopwatch.go Final round of db.DefaultContext refactor (#27587) 2023-10-14 08:37:24 +00:00
issue_test.go Implement FSFE REUSE for golang files (#21840) 2022-11-27 18:20:29 +00:00
issue_timetrack.go Final round of db.DefaultContext refactor (#27587) 2023-10-14 08:37:24 +00:00
issue_watch.go Introduce htmx and use it to avoid full page load on Subscribe and Follow (#28908) 2024-01-30 15:45:54 +01:00
main_test.go make writing main test easier (#27270) 2023-09-28 01:38:53 +00:00
middlewares.go Unify user update methods (#28733) 2024-02-04 13:29:09 +00:00
migrate.go Next round of db.DefaultContext refactor (#27089) 2023-09-16 14:39:12 +00:00
milestone.go Rework markup link rendering (#26745) 2024-01-15 08:49:24 +00:00
packages.go Fix the display of org level badges (#26504) 2023-09-06 14:38:14 +08:00
patch.go Refactor locale&string&template related code (#29165) 2024-02-16 15:20:52 +01:00
projects.go Refactor locale&string&template related code (#29165) 2024-02-16 15:20:52 +01:00
projects_test.go Move web/api context related testing function into a separate package (#26859) 2023-09-01 11:26:07 +00:00
pull.go Disallow merge when required checked are missing (#29143) 2024-02-19 22:58:33 +01:00
pull_review.go Refactor locale&string&template related code (#29165) 2024-02-16 15:20:52 +01:00
release.go Show commit status for releases (#29149) 2024-02-19 22:58:33 +01:00
release_test.go Move more functions to db.Find (#28419) 2024-01-15 02:19:25 +00:00
render.go Preserve BOM in web editor (#28935) 2024-01-27 18:02:51 +00:00
repo.go Don't do a full page load when clicking Watch or Star (#29001) 2024-02-05 09:56:20 +00:00
search.go Refactor indexer (#25174) 2023-06-23 12:37:56 +00:00
topic.go Next round of db.DefaultContext refactor (#27089) 2023-09-16 14:39:12 +00:00
treelist.go Implement FSFE REUSE for golang files (#21840) 2022-11-27 18:20:29 +00:00
view.go [FEAT] Enable ambiguous character detection in configured contexts 2024-02-23 13:12:17 +01:00
view_test.go Implement FSFE REUSE for golang files (#21840) 2022-11-27 18:20:29 +00:00
wiki.go [FEAT] Enable ambiguous character detection in configured contexts 2024-02-23 13:12:17 +01:00
wiki_test.go Simplify how git repositories are opened (#28937) 2024-01-27 21:09:51 +01:00