web frontend for git repositories, written in Go
git.pocka.jp/legit.git
Add test for not following symlink inside repo dir
Shota FUJI
(Jul 14, 2026, 7:43 PM +0900)
3b77efdc
f4a70d2b
+100
+100
routes/handler_test.go
+100
routes/handler_test.go
···
1
+
// Copyright 2026 Shota FUJI <pockawoooh@gmail.com>
2
+
// SPDX-License-Identifier: MIT
3
+
4
+
package routes
5
+
6
+
import (
7
+
"io"
8
+
"net/http"
9
+
"net/http/httptest"
10
+
"net/url"
11
+
"os"
12
+
"path/filepath"
13
+
"strings"
14
+
"testing"
15
+
16
+
"github.com/go-git/go-git/v5"
17
+
"github.com/go-git/go-git/v5/storage/memory"
18
+
"github.com/pocka/legit/config"
19
+
"github.com/pocka/legit/embed"
20
+
"github.com/pocka/legit/tests"
21
+
)
22
+
23
+
func TestIgnoreSymlinkByDefault(t *testing.T) {
24
+
src := t.TempDir()
25
+
dest := t.TempDir()
26
+
27
+
_, worktree, err := tests.CreateRepository(src, "foo")
28
+
if err != nil {
29
+
t.Fatal(err)
30
+
}
31
+
32
+
readme, err := worktree.Filesystem.Create("README.md")
33
+
if err != nil {
34
+
t.Fatal(err)
35
+
}
36
+
37
+
if _, err := readme.Write([]byte("* iawsoiwjfngbhfg812uhjikwe6789asfd")); err != nil {
38
+
t.Fatal(err)
39
+
}
40
+
41
+
_ = readme.Close()
42
+
43
+
if _, err := worktree.Add("README.md"); err != nil {
44
+
t.Fatal(err)
45
+
}
46
+
47
+
_, err = worktree.Commit("Add README", &git.CommitOptions{
48
+
Author: tests.SignatureAlice(),
49
+
})
50
+
if err != nil {
51
+
t.Fatalf("Unable to commit: %s", err)
52
+
}
53
+
54
+
os.Symlink(filepath.Join(src, "foo"), filepath.Join(dest, "foo"))
55
+
56
+
var c config.Config
57
+
c.Repo.ScanPath = dest
58
+
c.Repo.Readme = []string{"README.md"}
59
+
c.Repo.MainBranch = []string{"trunk"}
60
+
61
+
server := httptest.NewServer(Handlers(&c, embed.StaticDir(), embed.TemplatesDir()))
62
+
defer server.Close()
63
+
64
+
topPage, err := http.Get(server.URL)
65
+
if err != nil {
66
+
t.Fatal(err)
67
+
}
68
+
69
+
topPageBody, err := io.ReadAll(topPage.Body)
70
+
topPage.Body.Close()
71
+
if err != nil {
72
+
t.Fatal(err)
73
+
}
74
+
75
+
if strings.Contains(string(topPageBody), ">foo</") {
76
+
t.Error("Top page lists symlink-ed repository.")
77
+
}
78
+
79
+
target, err := url.JoinPath(server.URL, "/foo")
80
+
if err != nil {
81
+
t.Fatal(err)
82
+
}
83
+
84
+
res, err := http.Get(target)
85
+
if err != nil {
86
+
t.Fatal(err)
87
+
}
88
+
89
+
if res.StatusCode != http.StatusNotFound {
90
+
t.Errorf("Expected HTTP %d, Got %d", http.StatusNotFound, res.StatusCode)
91
+
}
92
+
93
+
_, err = git.Clone(memory.NewStorage(), nil, &git.CloneOptions{
94
+
URL: target,
95
+
ReferenceName: "refs/heads/trunk",
96
+
})
97
+
if err == nil {
98
+
t.Error("Expected clone error, got successful clone.")
99
+
}
100
+
}