mirror of
https://codeberg.org/forgejo/forgejo.git
synced 2026-05-13 06:20:24 +00:00
One of the security patches released 2026-03-09 [fixed a vulnerability](https://codeberg.org/forgejo/forgejo/pulls/11513/commits/d1c7b04d09f6a13896eaa1322ac690b2021539da) caused by a misapplication of Go `case` statements, where the implementation would have been correct if Go `case` statements automatically fall through to the next case block, but they do not. This PR adds a semgrep rule which detects any empty `case` statement and raises an error, in order to prevent this coding mistake in the future. For example, code like this will now trigger a build error: ```go switch setting.Protocol { case setting.HTTPUnix: case setting.FCGI: case setting.FCGIUnix: default: defaultLocalURL := string(setting.Protocol) + "://" } ``` Example error: ``` cmd/web.go ❯❯❱ semgrep.config.forgejo-switch-empty-case switch has a case block with no content. This is treated as "break" by Go, but developers may confuse it for "fallthrough". To fix this error, disambiguate by using "break" or "fallthrough". 279┆ switch setting.Protocol { 280┆ case setting.HTTPUnix: 281┆ case setting.FCGI: 282┆ case setting.FCGIUnix: 283┆ default: 284┆ defaultLocalURL := string(setting.Protocol) + "://" 285┆ if setting.HTTPAddr == "0.0.0.0" { 286┆ defaultLocalURL += "localhost" 287┆ } else { 288┆ defaultLocalURL += setting.HTTPAddr ``` As described in the error output, this error can be fixed by explicitly listing `break` (the real Go behaviour, to do nothing in the block), or by listing `fallthrough` (if the intent was to fall through). All existing code triggering this detection has been changed to `break` (or, rarely, irrelevant cases have been removed), which should maintain the same code functionality. While performing this fixup, a light analysis was performed on each case and they *appeared* correct, but with ~65 cases I haven't gone into extreme depth. Tests are present for the semgrep rule in `.semgrep/tests/go.go`. ## Checklist The [contributor guide](https://forgejo.org/docs/next/contributor/) contains information that will be helpful to first time contributors. There also are a few [conditions for merging Pull Requests in Forgejo repositories](https://codeberg.org/forgejo/governance/src/branch/main/PullRequestsAgreement.md). You are also welcome to join the [Forgejo development chatroom](https://matrix.to/#/#forgejo-development:matrix.org). ### Documentation - [ ] I created a pull request [to the documentation](https://codeberg.org/forgejo/docs) to explain to Forgejo users how to use this change. - [x] I did not document these changes and I do not expect someone else to do it. ### Release notes - [ ] This change will be noticed by a Forgejo user or admin (feature, bug fix, performance, etc.). I suggest to include a release note for this change. - [x] This change is not visible to a Forgejo user or admin (refactor, dependency upgrade, etc.). I think there is no need to add a release note for this change. Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/11593 Reviewed-by: Gusted <gusted@noreply.codeberg.org> Co-authored-by: Mathieu Fenniak <mathieu@fenniak.net> Co-committed-by: Mathieu Fenniak <mathieu@fenniak.net>
155 lines
4.8 KiB
Go
155 lines
4.8 KiB
Go
// Copyright 2019 Gitea. All rights reserved.
|
|
// SPDX-License-Identifier: MIT
|
|
|
|
package task
|
|
|
|
import (
|
|
"context"
|
|
"errors"
|
|
"fmt"
|
|
"strings"
|
|
"time"
|
|
|
|
admin_model "forgejo.org/models/admin"
|
|
"forgejo.org/models/db"
|
|
repo_model "forgejo.org/models/repo"
|
|
user_model "forgejo.org/models/user"
|
|
"forgejo.org/modules/graceful"
|
|
"forgejo.org/modules/json"
|
|
"forgejo.org/modules/log"
|
|
"forgejo.org/modules/migration"
|
|
"forgejo.org/modules/process"
|
|
"forgejo.org/modules/structs"
|
|
"forgejo.org/modules/timeutil"
|
|
"forgejo.org/modules/util"
|
|
"forgejo.org/services/migrations"
|
|
notify_service "forgejo.org/services/notify"
|
|
)
|
|
|
|
func handleCreateError(owner *user_model.User, err error) error {
|
|
switch {
|
|
case repo_model.IsErrReachLimitOfRepo(err):
|
|
return fmt.Errorf("you have already reached your limit of %d repositories", owner.MaxCreationLimit())
|
|
case repo_model.IsErrRepoAlreadyExist(err):
|
|
return errors.New("the repository name is already used")
|
|
case db.IsErrNameReserved(err):
|
|
return fmt.Errorf("the repository name '%s' is reserved", err.(db.ErrNameReserved).Name)
|
|
case db.IsErrNamePatternNotAllowed(err):
|
|
return fmt.Errorf("the pattern '%s' is not allowed in a repository name", err.(db.ErrNamePatternNotAllowed).Pattern)
|
|
default:
|
|
return err
|
|
}
|
|
}
|
|
|
|
func runMigrateTask(ctx context.Context, t *admin_model.Task) (err error) {
|
|
defer func(ctx context.Context) {
|
|
if e := recover(); e != nil {
|
|
err = fmt.Errorf("PANIC whilst trying to do migrate task: %v", e)
|
|
log.Critical("PANIC during runMigrateTask[%d] by DoerID[%d] to RepoID[%d] for OwnerID[%d]: %v\nStacktrace: %v", t.ID, t.DoerID, t.RepoID, t.OwnerID, e, log.Stack(2))
|
|
}
|
|
if err == nil {
|
|
err = admin_model.FinishMigrateTask(ctx, t)
|
|
if err == nil {
|
|
notify_service.MigrateRepository(ctx, t.Doer, t.Owner, t.Repo)
|
|
return
|
|
}
|
|
|
|
log.Error("FinishMigrateTask[%d] by DoerID[%d] to RepoID[%d] for OwnerID[%d] failed: %v", t.ID, t.DoerID, t.RepoID, t.OwnerID, err)
|
|
}
|
|
|
|
log.Error("runMigrateTask[%d] by DoerID[%d] to RepoID[%d] for OwnerID[%d] failed: %v", t.ID, t.DoerID, t.RepoID, t.OwnerID, err)
|
|
|
|
t.EndTime = timeutil.TimeStampNow()
|
|
t.Status = structs.TaskStatusFailed
|
|
t.Message = err.Error()
|
|
if err := t.UpdateCols(ctx, "status", "message", "end_time"); err != nil {
|
|
log.Error("Task UpdateCols failed: %v", err)
|
|
}
|
|
|
|
// then, do not delete the repository, otherwise the users won't be able to see the last error
|
|
}(graceful.GetManager().ShutdownContext()) // even if the parent ctx is canceled, this defer-function still needs to update the task record in database
|
|
|
|
if err = t.LoadRepo(ctx); err != nil {
|
|
return err
|
|
}
|
|
|
|
// if repository is ready, then just finish the task
|
|
if t.Repo.Status == repo_model.RepositoryReady {
|
|
return nil
|
|
}
|
|
|
|
if err = t.LoadDoer(ctx); err != nil {
|
|
return err
|
|
}
|
|
if err = t.LoadOwner(ctx); err != nil {
|
|
return err
|
|
}
|
|
|
|
var opts *migration.MigrateOptions
|
|
opts, err = t.MigrateConfig()
|
|
if err != nil {
|
|
return err
|
|
}
|
|
|
|
opts.MigrateToRepoID = t.RepoID
|
|
|
|
pm := process.GetManager()
|
|
ctx, cancel, finished := pm.AddContext(graceful.GetManager().ShutdownContext(), fmt.Sprintf("MigrateTask: %s/%s", t.Owner.Name, opts.RepoName))
|
|
defer finished()
|
|
|
|
t.StartTime = timeutil.TimeStampNow()
|
|
t.Status = structs.TaskStatusRunning
|
|
if err = t.UpdateCols(ctx, "start_time", "status"); err != nil {
|
|
return err
|
|
}
|
|
|
|
// check whether the task should be canceled, this goroutine is also managed by process manager
|
|
go func() {
|
|
for {
|
|
select {
|
|
case <-time.After(2 * time.Second):
|
|
break
|
|
case <-ctx.Done():
|
|
return
|
|
}
|
|
task, _ := admin_model.GetMigratingTask(ctx, t.RepoID)
|
|
if task != nil && task.Status != structs.TaskStatusRunning {
|
|
log.Debug("MigrateTask[%d] by DoerID[%d] to RepoID[%d] for OwnerID[%d] is canceled due to status is not 'running'", t.ID, t.DoerID, t.RepoID, t.OwnerID)
|
|
cancel()
|
|
return
|
|
}
|
|
}
|
|
}()
|
|
|
|
t.Repo, err = migrations.MigrateRepository(ctx, t.Doer, t.Owner.Name, *opts, func(format string, args ...any) {
|
|
message := admin_model.TranslatableMessage{
|
|
Format: format,
|
|
Args: args,
|
|
}
|
|
bs, _ := json.Marshal(message)
|
|
t.Message = string(bs)
|
|
_ = t.UpdateCols(ctx, "message")
|
|
})
|
|
|
|
if err == nil {
|
|
log.Trace("Repository migrated [%d]: %s/%s", t.Repo.ID, t.Owner.Name, t.Repo.Name)
|
|
return nil
|
|
}
|
|
|
|
if repo_model.IsErrRepoAlreadyExist(err) {
|
|
return errors.New("the repository name is already used")
|
|
}
|
|
|
|
// remoteAddr may contain credentials, so we sanitize it
|
|
err = util.SanitizeErrorCredentialURLs(err)
|
|
if strings.Contains(err.Error(), "Authentication failed") ||
|
|
strings.Contains(err.Error(), "could not read Username") {
|
|
return fmt.Errorf("authentication failed: %w", err)
|
|
} else if strings.Contains(err.Error(), "fatal:") {
|
|
return fmt.Errorf("migration failed: %w", err)
|
|
}
|
|
|
|
// do not be tempted to coalesce this line with the return
|
|
err = handleCreateError(t.Owner, err)
|
|
return err
|
|
}
|