Verify external assets without forwarding Gitea credentials

2026-10-06 01:01:36 +00:00
parent 8b417760c6
commit 6b777dd861
4 changed files with 60 additions and 28 deletions
--- a/internal/gitea/assets_test.go
+++ b/internal/gitea/assets_test.go
@@ -249,26 +249,48 @@ func TestInspectAssetsFollowsSameOriginRedirectWithAuthorization(t *testing.T) {
 	}
 }

-func TestInspectAssetsNeverSendsTokenToCrossOriginRedirect(t *testing.T) {
-	var externalCalled atomic.Bool
-	external := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { externalCalled.Store(true) }))
-	defer external.Close()
-	expected := assetFor("app.bin", []byte("alpha"))
-	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		assertAssetGET(t, r, "")
-		if r.URL.Path == assetListPath {
-			writeAssetList(t, w, []assetResponse{{ID: 1, Name: expected.Filename, Size: expected.Size, BrowserDownloadURL: "/files/redirect"}})
-			return
-		}
-		http.Redirect(w, r, external.URL+"/private", http.StatusFound)
-	}))
-	defer server.Close()
-	inspection, err := testClient(server).InspectAssets(context.Background(), testDestination(server.URL), 10, []ExpectedAsset{expected})
-	if err != nil {
-		t.Fatal(err)
-	}
-	if inspection.Assets[0].State != AssetUnverifiable || externalCalled.Load() {
-		t.Fatalf("inspection = %#v, cross-origin called = %t", inspection, externalCalled.Load())
+func TestInspectAssetsVerifiesExternalContentWithoutGiteaToken(t *testing.T) {
+	for _, mode := range []string{"direct", "redirect", "conflicting"} {
+		t.Run(mode, func(t *testing.T) {
+			expected := assetFor("app.bin", []byte("matching bytes"))
+			externalGets := 0
+			external := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+				externalGets++
+				if r.Header.Get("Authorization") != "" {
+					t.Error("Gitea token reached external host")
+				}
+				content := []byte("matching bytes")
+				if mode == "conflicting" {
+					content = []byte("different bytes")
+				}
+				w.Write(content)
+			}))
+			defer external.Close()
+			origin := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+				assertAssetGET(t, r, "")
+				if r.URL.Path == assetListPath {
+					download := external.URL + "/content"
+					if mode == "redirect" {
+						download = "/redirect"
+					}
+					writeAssetList(t, w, []assetResponse{{ID: 1, Name: expected.Filename, Size: expected.Size, BrowserDownloadURL: download}})
+					return
+				}
+				http.Redirect(w, r, external.URL+"/content", http.StatusFound)
+			}))
+			defer origin.Close()
+			inspection, err := testClient(origin).InspectAssets(context.Background(), testDestination(origin.URL), 10, []ExpectedAsset{expected})
+			if err != nil {
+				t.Fatal(err)
+			}
+			want := AssetMatching
+			if mode == "conflicting" {
+				want = AssetConflicting
+			}
+			if inspection.Assets[0].State != want || externalGets != 1 {
+				t.Fatalf("inspection=%#v downloads=%d", inspection, externalGets)
+			}
+		})
 	}
 }