githaven-fork/modules
zeripath bbffcc3aec
Multiple Escaping Improvements (#17551)
There are multiple places where Gitea does not properly escape URLs that it is building and there are multiple places where it builds urls when there is already a simpler function available to use this.
    
This is an extensive PR attempting to fix these issues.

1. The first commit in this PR looks through all href, src and links in the Gitea codebase and has attempted to catch all the places where there is potentially incomplete escaping.
2. Whilst doing this we will prefer to use functions that create URLs over recreating them by hand.
3. All uses of strings should be directly escaped - even if they are not currently expected to contain escaping characters. The main benefit to doing this will be that we can consider relaxing the constraints on user names and reponames in future. 
4. The next commit looks at escaping in the wiki and re-considers the urls that are used there. Using the improved escaping here wiki files containing '/'. (This implementation will currently still place all of the wiki files the root directory of the repo but this would not be difficult to change.)
5. The title generation in feeds is now properly escaped.
6. EscapePound is no longer needed - urls should be PathEscaped / QueryEscaped as necessary but then re-escaped with Escape when creating html with locales Signed-off-by: Andrew Thornton <art27@cantab.net>

Signed-off-by: Andrew Thornton <art27@cantab.net>
2021-11-16 18:18:25 +00:00
..
activitypub Create pub/priv keypair for federation (#17071) 2021-09-28 15:19:22 -04:00
analyze Use git attributes to determine generated and vendored status for language stats and diffs (#16773) 2021-09-09 21:13:36 +01:00
appstate Decouple unit test code from business code (#17623) 2021-11-12 22:36:47 +08:00
auth Add bundle download for repository (#14538) 2021-08-24 11:47:09 -05:00
avatar refactor: move from io/ioutil to io and os package (#17109) 2021-09-22 13:38:34 +08:00
base Fixed assert statements. (#16089) 2021-06-07 07:27:09 +02:00
cache Add an abstract json layout to make it's easier to change json library (#16528) 2021-07-24 18:03:58 +02:00
charset Read expected buffer size (#17409) 2021-10-24 22:12:43 +01:00
context Multiple Escaping Improvements (#17551) 2021-11-16 18:18:25 +00:00
convert Multiple Escaping Improvements (#17551) 2021-11-16 18:18:25 +00:00
csv Properly determine CSV delimiter (#17459) 2021-10-30 23:50:40 +08:00
doctor Move unit into models/unit/ (#17576) 2021-11-09 20:57:58 +01:00
emoji Run processors on whole of text (#16155) 2021-06-17 11:35:05 +01:00
eventsource Add an abstract json layout to make it's easier to change json library (#16528) 2021-07-24 18:03:58 +02:00
generate switch to maintained lib (#16532) 2021-07-24 13:00:41 +02:00
git Multiple Escaping Improvements (#17551) 2021-11-16 18:18:25 +00:00
gitgraph Fix some lints (#17337) 2021-10-17 20:47:12 +01:00
graceful Fix some lints (#17337) 2021-10-17 20:47:12 +01:00
hcaptcha hCaptcha Support (#12594) 2020-10-02 23:37:53 -04:00
highlight Prevent panic in Org mode HighlightCodeBlock (#17140) 2021-09-24 14:29:32 +01:00
hostmatcher Only allow webhook to send requests to allowed hosts (#17482) 2021-11-01 16:39:52 +08:00
httpcache Use a variable but a function for IsProd because of a slight performance increment (#17368) 2021-10-20 16:37:19 +02:00
httplib refactor: move from io/ioutil to io and os package (#17109) 2021-09-22 13:38:34 +08:00
indexer Fix nil checking on typed interface (#17598) 2021-11-15 21:16:11 +08:00
json Add an abstract json layout to make it's easier to change json library (#16528) 2021-07-24 18:03:58 +02:00
lfs Fix some lints (#17337) 2021-10-17 20:47:12 +01:00
log refactor: move from io/ioutil to io and os package (#17109) 2021-09-22 13:38:34 +08:00
markup Add copy button to markdown code blocks (#17638) 2021-11-16 16:16:05 +08:00
matchlist Add Allow-/Block-List for Migrate & Mirrors (#13610) 2020-11-28 19:37:58 -05:00
metrics Add metrics to get issues by repository (#17225) 2021-10-05 20:39:37 +02:00
migration Move migrations into services and base into modules/migration (#17663) 2021-11-16 23:25:33 +08:00
nosql Fix setting redis db path (#15698) 2021-05-03 13:24:24 -04:00
notification Decouple unit test, remove intermediate unittestbridge package (#17662) 2021-11-16 16:53:21 +08:00
options refactor: move from io/ioutil to io and os package (#17109) 2021-09-22 13:38:34 +08:00
password Fixed assert statements. (#16089) 2021-06-07 07:27:09 +02:00
pprof refactor: move from io/ioutil to io and os package (#17109) 2021-09-22 13:38:34 +08:00
private refactor: move from io/ioutil to io and os package (#17109) 2021-09-22 13:38:34 +08:00
process Code Formats, Nits & Unused Func/Var deletions (#15286) 2021-04-09 09:40:34 +02:00
proxy Return nil proxy function if proxy not enabled (#16742) 2021-08-19 16:41:20 -04:00
public refactor: move from io/ioutil to io and os package (#17109) 2021-09-22 13:38:34 +08:00
queue Make the Mirror Queue a queue (#17326) 2021-10-17 12:43:25 +01:00
recaptcha refactor: move from io/ioutil to io and os package (#17109) 2021-09-22 13:38:34 +08:00
references Fix various documentation, user-facing, and source comment typos (#16367) 2021-07-08 13:38:13 +02:00
repofiles Multiple Escaping Improvements (#17551) 2021-11-16 18:18:25 +00:00
repository Multiple Escaping Improvements (#17551) 2021-11-16 18:18:25 +00:00
secret Fix various documentation, user-facing, and source comment typos (#16367) 2021-07-08 13:38:13 +02:00
session Move session to models/login (#17338) 2021-10-17 19:51:56 +01:00
setting Use correct defaultValue for stracktrace (#17552) 2021-11-05 13:25:05 +02:00
ssh Fix ipv6 parsing for builtin ssh server (#17561) 2021-11-06 14:23:32 +08:00
storage refactor: move from io/ioutil to io and os package (#17109) 2021-09-22 13:38:34 +08:00
structs Add migration from GitBucket (#16767) 2021-11-14 20:11:10 +01:00
svg refactor: move from io/ioutil to io and os package (#17109) 2021-09-22 13:38:34 +08:00
sync Fix missing unlock in uniquequeue (#9790) 2020-01-15 23:58:33 +02:00
task Move migrations into services and base into modules/migration (#17663) 2021-11-16 23:25:33 +08:00
templates Multiple Escaping Improvements (#17551) 2021-11-16 18:18:25 +00:00
test Decouple unit test, remove intermediate unittestbridge package (#17662) 2021-11-16 16:53:21 +08:00
timeutil Allow mocking timeutil (#17354) 2021-10-18 21:12:26 +01:00
translation Use index of the supported tags to choose user lang (#15452) 2021-04-14 19:52:01 +01:00
typesniffer Read expected buffer size (#17409) 2021-10-24 22:12:43 +01:00
updatechecker Refactor update checker to use AppState (#17387) 2021-10-21 17:10:49 +01:00
upload Multiple Escaping Improvements (#17551) 2021-11-16 18:18:25 +00:00
uri Dump github/gitlab/gitea repository data to a local directory and restore to gitea (#12244) 2020-12-27 11:34:19 +08:00
user Add gitea-vet (#10948) 2020-04-05 07:20:50 +01:00
util Only allow webhook to send requests to allowed hosts (#17482) 2021-11-01 16:39:52 +08:00
validation Upgrade chi to v5 (#17298) 2021-10-13 22:50:23 -04:00
web Upgrade chi to v5 (#17298) 2021-10-13 22:50:23 -04:00