mirrors/gitea
1
0
Fork 0
mirror of https://github.com/go-gitea/gitea.git synced 2026-08-23 15:41:39 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(actions): enforce workflow badge token scope (#39044)

Browse Source 
Apply repository token-scope and public-only checks to workflow badges.

---------

Co-authored-by: silverwind <me@silverwind.io>
This commit is contained in:
bircni
2026-08-23 08:59:58 +02:00
committed by GitHub
parent 204c0bafd3
commit 55a5f50961
2 changed files with 30 additions and 21 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
routers/web/repo/actions/badge.go
View File

@@ -10,6 +10,7 @@ import (
"strings"
actions_model "gitea.dev/models/actions"
auth_model "gitea.dev/models/auth"
"gitea.dev/modules/badge"
"gitea.dev/modules/git"
"gitea.dev/modules/util"
@@ -17,6 +18,11 @@ import (
)
func GetWorkflowBadge(ctx *context.Context) {
context.CheckRepoScopedToken(ctx, ctx.Repo.Repository, auth_model.Read)
if ctx.Written() {
return
}
workflowFile := ctx.PathParam("workflow_name")
branch := ctx.FormString("branch", ctx.Repo.Repository.DefaultBranch)
event := ctx.FormString("event")

45
tests/integration/repo_home_token_scope_test.go
View File

@@ -11,30 +11,33 @@ import (
"gitea.dev/tests"
)
// TestRepoHomeContentTokenScopes ensures the web repository home page enforces the
// repository read scope (and public-only confinement) of an API token used via basic
// auth, so a wrongly-scoped token cannot read private repository content.
func TestRepoHomeContentTokenScopes(t *testing.T) {
func TestRepoWebTokenScopes(t *testing.T) {
defer tests.PrepareTestEnv(t)()
// user2/repo2 is a private repository owned by user2
const url = "/user2/repo2"
// a token without repository scope must be denied
miscToken := getUserToken(t, "user2", auth_model.AccessTokenScopeReadMisc)
reqDenied := NewRequest(t, "GET", url)
reqDenied.SetBasicAuth("user2", miscToken)
MakeRequest(t, reqDenied, http.StatusForbidden)
// a public-only token must be denied on a private repo
publicOnlyToken := getUserToken(t, "user2", auth_model.AccessTokenScopeReadRepository, auth_model.AccessTokenScopePublicOnly)
reqPublicOnly := NewRequest(t, "GET", url)
reqPublicOnly.SetBasicAuth("user2", publicOnlyToken)
MakeRequest(t, reqPublicOnly, http.StatusForbidden)
readToken := getUserToken(t, "user2", auth_model.AccessTokenScopeReadRepository)
// a token with repository read scope is allowed
ownerReadToken := getUserToken(t, "user2", auth_model.AccessTokenScopeReadRepository)
reqAllowed := NewRequest(t, "GET", url)
reqAllowed.SetBasicAuth("user2", ownerReadToken)
MakeRequest(t, reqAllowed, http.StatusOK)
for _, test := range []struct {
name string
url string
}{
{"repository home", "/user2/repo2"},
{"workflow badge", "/org3/repo3/actions/workflows/test.yml/badge.svg"},
} {
t.Run(test.name, func(t *testing.T) {
assertBasicAuthStatus(t, test.url, miscToken, http.StatusForbidden)
assertBasicAuthStatus(t, test.url, publicOnlyToken, http.StatusForbidden)
assertBasicAuthStatus(t, test.url, readToken, http.StatusOK)
})
}
assertBasicAuthStatus(t, "/user2/repo1/actions/workflows/test.yml/badge.svg", publicOnlyToken, http.StatusOK)
}
func assertBasicAuthStatus(t *testing.T, url, token string, status int) {
t.Helper()
req := NewRequest(t, http.MethodGet, url)
req.SetBasicAuth("user2", token)
MakeRequest(t, req, status)
}