Skip to content

Commit d5c2743

Browse files
lunnylunny
authored
Revert "Use CleanPath instead of path.Clean (#23371)"
This reverts commit b116418.
1 parent 0d7cf7b commit d5c2743

File tree

13 files changed

+28
-45
lines changed

13 files changed

+28
-45
lines changed

‎models/git/lfs_lock.go

Lines changed: 8 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,7 @@ package git
66
import (
77
"context"
88
"fmt"
9+
"path"
910
"strings"
1011
"time"
1112

@@ -16,7 +17,6 @@ import (
1617
"code.gitea.io/gitea/models/unit"
1718
user_model "code.gitea.io/gitea/models/user"
1819
"code.gitea.io/gitea/modules/setting"
19-
"code.gitea.io/gitea/modules/util"
2020
)
2121

2222
// LFSLock represents a git lfs lock of repository.
@@ -34,7 +34,11 @@ func init() {
3434

3535
// BeforeInsert is invoked from XORM before inserting an object of this type.
3636
func (l *LFSLock) BeforeInsert() {
37-
l.Path = util.CleanPath(l.Path)
37+
l.Path = cleanPath(l.Path)
38+
}
39+
40+
func cleanPath(p string) string {
41+
return path.Clean("/" + p)[1:]
3842
}
3943

4044
// CreateLFSLock creates a new lock.
@@ -49,7 +53,7 @@ func CreateLFSLock(ctx context.Context, repo *repo_model.Repository, lock *LFSLo
4953
return nil, err
5054
}
5155

52-
lock.Path = util.CleanPath(lock.Path)
56+
lock.Path = cleanPath(lock.Path)
5357
lock.RepoID = repo.ID
5458

5559
l, err := GetLFSLock(dbCtx, repo, lock.Path)
@@ -69,7 +73,7 @@ func CreateLFSLock(ctx context.Context, repo *repo_model.Repository, lock *LFSLo
6973

7074
// GetLFSLock returns release by given path.
7175
func GetLFSLock(ctx context.Context, repo *repo_model.Repository, path string) (*LFSLock, error) {
72-
path = util.CleanPath(path)
76+
path = cleanPath(path)
7377
rel := &LFSLock{RepoID: repo.ID}
7478
has, err := db.GetEngine(ctx).Where("lower(path) = ?", strings.ToLower(path)).Get(rel)
7579
if err != nil {

‎modules/options/base.go

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -16,27 +16,27 @@ import (
1616

1717
// Locale reads the content of a specific locale from static/bindata or custom path.
1818
func Locale(name string) ([]byte, error) {
19-
return fileFromDir(path.Join("locale", util.CleanPath(name)))
19+
return fileFromDir(path.Join("locale", path.Clean("/"+name)))
2020
}
2121

2222
// Readme reads the content of a specific readme from static/bindata or custom path.
2323
func Readme(name string) ([]byte, error) {
24-
return fileFromDir(path.Join("readme", util.CleanPath(name)))
24+
return fileFromDir(path.Join("readme", path.Clean("/"+name)))
2525
}
2626

2727
// Gitignore reads the content of a gitignore locale from static/bindata or custom path.
2828
func Gitignore(name string) ([]byte, error) {
29-
return fileFromDir(path.Join("gitignore", util.CleanPath(name)))
29+
return fileFromDir(path.Join("gitignore", path.Clean("/"+name)))
3030
}
3131

3232
// License reads the content of a specific license from static/bindata or custom path.
3333
func License(name string) ([]byte, error) {
34-
return fileFromDir(path.Join("license", util.CleanPath(name)))
34+
return fileFromDir(path.Join("license", path.Clean("/"+name)))
3535
}
3636

3737
// Labels reads the content of a specific labels from static/bindata or custom path.
3838
func Labels(name string) ([]byte, error) {
39-
return fileFromDir(path.Join("label", util.CleanPath(name)))
39+
return fileFromDir(path.Join("label", path.Clean("/"+name)))
4040
}
4141

4242
// WalkLocales reads the content of a specific locale

‎modules/public/public.go

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -6,14 +6,14 @@ package public
66
import (
77
"net/http"
88
"os"
9+
"path"
910
"path/filepath"
1011
"strings"
1112

1213
"code.gitea.io/gitea/modules/container"
1314
"code.gitea.io/gitea/modules/httpcache"
1415
"code.gitea.io/gitea/modules/log"
1516
"code.gitea.io/gitea/modules/setting"
16-
"code.gitea.io/gitea/modules/util"
1717
)
1818

1919
// Options represents the available options to configure the handler.
@@ -103,7 +103,7 @@ func setWellKnownContentType(w http.ResponseWriter, file string) {
103103

104104
func (opts *Options) handle(w http.ResponseWriter, req *http.Request, fs http.FileSystem, file string) bool {
105105
// use clean to keep the file is a valid path with no . or ..
106-
f, err := fs.Open(util.CleanPath(file))
106+
f, err := fs.Open(path.Clean(file))
107107
if err != nil {
108108
if os.IsNotExist(err) {
109109
return false

‎modules/storage/local.go

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,7 @@ import (
88
"io"
99
"net/url"
1010
"os"
11+
"path"
1112
"path/filepath"
1213
"strings"
1314

@@ -58,7 +59,7 @@ func NewLocalStorage(ctx context.Context, cfg interface{}) (ObjectStorage, error
5859
}
5960

6061
func (l *LocalStorage) buildLocalPath(p string) string {
61-
return filepath.Join(l.dir, util.CleanPath(strings.ReplaceAll(p, "\\", "/")))
62+
return filepath.Join(l.dir, path.Clean("/" + strings.ReplaceAll(p, "\\", "/"))[1:])
6263
}
6364

6465
// Open a file

‎modules/storage/minio.go

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,6 @@ import (
1515
"time"
1616

1717
"code.gitea.io/gitea/modules/log"
18-
"code.gitea.io/gitea/modules/util"
1918

2019
"github.com/minio/minio-go/v7"
2120
"github.com/minio/minio-go/v7/pkg/credentials"
@@ -121,7 +120,7 @@ func NewMinioStorage(ctx context.Context, cfg interface{}) (ObjectStorage, error
121120
}
122121

123122
func (m *MinioStorage) buildMinioPath(p string) string {
124-
return strings.TrimPrefix(path.Join(m.basePath, util.CleanPath(strings.ReplaceAll(p, "\\", "/"))), "/")
123+
return strings.TrimPrefix(path.Join(m.basePath, path.Clean("/" + strings.ReplaceAll(p, "\\", "/"))[1:]), "/")
125124
}
126125

127126
// Open open a file

‎modules/util/path.go

Lines changed: 0 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -14,14 +14,6 @@ import (
1414
"strings"
1515
)
1616

17-
// CleanPath ensure to clean the path
18-
func CleanPath(p string) string {
19-
if strings.HasPrefix(p, "/") {
20-
return path.Clean(p)
21-
}
22-
return path.Clean("/" + p)[1:]
23-
}
24-
2517
// EnsureAbsolutePath ensure that a path is absolute, making it
2618
// relative to absoluteBase if necessary
2719
func EnsureAbsolutePath(path, absoluteBase string) string {

‎modules/util/path_test.go

Lines changed: 0 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -136,15 +136,3 @@ func TestMisc_IsReadmeFileName(t *testing.T) {
136136
assert.Equal(t, testCase.idx, idx)
137137
}
138138
}
139-
140-
func TestCleanPath(t *testing.T) {
141-
cases := map[string]string{
142-
"../../test": "test",
143-
"/test": "/test",
144-
"/../test": "/test",
145-
}
146-
147-
for k, v := range cases {
148-
assert.Equal(t, v, CleanPath(k))
149-
}
150-
}

‎routers/web/base.go

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,6 @@ import (
1919
"code.gitea.io/gitea/modules/setting"
2020
"code.gitea.io/gitea/modules/storage"
2121
"code.gitea.io/gitea/modules/templates"
22-
"code.gitea.io/gitea/modules/util"
2322
"code.gitea.io/gitea/modules/web/middleware"
2423
"code.gitea.io/gitea/modules/web/routing"
2524
"code.gitea.io/gitea/services/auth"
@@ -45,7 +44,7 @@ func storageHandler(storageSetting setting.Storage, prefix string, objStore stor
4544
routing.UpdateFuncInfo(req.Context(), funcInfo)
4645

4746
rPath := strings.TrimPrefix(req.URL.Path, "/"+prefix+"/")
48-
rPath = util.CleanPath(strings.ReplaceAll(rPath, "\\", "/"))
47+
rPath = path.Clean("/" + strings.ReplaceAll(rPath, "\\", "/"))[1:]
4948

5049
u, err := objStore.URL(rPath, path.Base(rPath))
5150
if err != nil {
@@ -81,7 +80,7 @@ func storageHandler(storageSetting setting.Storage, prefix string, objStore stor
8180
routing.UpdateFuncInfo(req.Context(), funcInfo)
8281

8382
rPath := strings.TrimPrefix(req.URL.Path, "/"+prefix+"/")
84-
rPath = util.CleanPath(strings.ReplaceAll(rPath, "\\", "/"))
83+
rPath = path.Clean("/" + strings.ReplaceAll(rPath, "\\", "/"))[1:]
8584
if rPath == "" {
8685
http.Error(w, "file not found", http.StatusNotFound)
8786
return

‎routers/web/repo/editor.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -726,7 +726,7 @@ func UploadFilePost(ctx *context.Context) {
726726

727727
func cleanUploadFileName(name string) string {
728728
// Rebase the filename
729-
name = strings.Trim(util.CleanPath(name), "/")
729+
name = strings.Trim(path.Clean("/"+name), "/")
730730
// Git disallows any filenames to have a .git directory in them.
731731
for _, part := range strings.Split(name, "/") {
732732
if strings.ToLower(part) == ".git" {

‎routers/web/repo/lfs.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -207,7 +207,7 @@ func LFSLockFile(ctx *context.Context) {
207207
ctx.Redirect(ctx.Repo.RepoLink + "/settings/lfs/locks")
208208
return
209209
}
210-
lockPath = util.CleanPath(lockPath)
210+
lockPath = path.Clean("/" + lockPath)[1:]
211211
if len(lockPath) == 0 {
212212
ctx.Flash.Error(ctx.Tr("repo.settings.lfs_invalid_locking_path", originalPath))
213213
ctx.Redirect(ctx.Repo.RepoLink + "/settings/lfs/locks")

‎services/migrations/gitea_uploader.go

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,7 @@ import (
99
"fmt"
1010
"io"
1111
"os"
12+
"path"
1213
"path/filepath"
1314
"strconv"
1415
"strings"
@@ -29,7 +30,6 @@ import (
2930
"code.gitea.io/gitea/modules/structs"
3031
"code.gitea.io/gitea/modules/timeutil"
3132
"code.gitea.io/gitea/modules/uri"
32-
"code.gitea.io/gitea/modules/util"
3333
"code.gitea.io/gitea/services/pull"
3434

3535
"github.com/google/uuid"
@@ -866,7 +866,7 @@ func (g *GiteaLocalUploader) CreateReviews(reviews ...*base.Review) error {
866866
}
867867

868868
// SECURITY: The TreePath must be cleaned!
869-
comment.TreePath = util.CleanPath(comment.TreePath)
869+
comment.TreePath = path.Clean("/" + comment.TreePath)[1:]
870870

871871
var patch string
872872
reader, writer := io.Pipe()

‎services/packages/container/blob_uploader.go

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -8,13 +8,13 @@ import (
88
"errors"
99
"io"
1010
"os"
11+
"path"
1112
"path/filepath"
1213
"strings"
1314

1415
packages_model "code.gitea.io/gitea/models/packages"
1516
packages_module "code.gitea.io/gitea/modules/packages"
1617
"code.gitea.io/gitea/modules/setting"
17-
"code.gitea.io/gitea/modules/util"
1818
)
1919

2020
var (
@@ -33,7 +33,7 @@ type BlobUploader struct {
3333
}
3434

3535
func buildFilePath(id string) string {
36-
return filepath.Join(setting.Packages.ChunkedUploadPath, util.CleanPath(strings.ReplaceAll(id, "\\", "/")))
36+
return filepath.Join(setting.Packages.ChunkedUploadPath, path.Clean("/" + strings.ReplaceAll(id, "\\", "/"))[1:])
3737
}
3838

3939
// NewBlobUploader creates a new blob uploader for the given id

‎services/repository/files/file.go

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -7,14 +7,14 @@ import (
77
"context"
88
"fmt"
99
"net/url"
10+
"path"
1011
"strings"
1112
"time"
1213

1314
repo_model "code.gitea.io/gitea/models/repo"
1415
user_model "code.gitea.io/gitea/models/user"
1516
"code.gitea.io/gitea/modules/git"
1617
api "code.gitea.io/gitea/modules/structs"
17-
"code.gitea.io/gitea/modules/util"
1818
)
1919

2020
// GetFileResponseFromCommit Constructs a FileResponse from a Commit object
@@ -129,7 +129,7 @@ func GetAuthorAndCommitterUsers(author, committer *IdentityOptions, doer *user_m
129129
// CleanUploadFileName Trims a filename and returns empty string if it is a .git directory
130130
func CleanUploadFileName(name string) string {
131131
// Rebase the filename
132-
name = strings.Trim(util.CleanPath(name), "/")
132+
name = strings.Trim(path.Clean("/"+name), "/")
133133
// Git disallows any filenames to have a .git directory in them.
134134
for _, part := range strings.Split(name, "/") {
135135
if strings.ToLower(part) == ".git" {

0 commit comments

Comments
 (0)