Do not traverse unaccessible subdirectories (issue 51)

lemval

2012-01-31 1c30dad2115fc513791d8a5b292ad0f7d7b85749

 tests/com/gitblit/tests/GitServletTest.java

@@ -1,12 +1,15 @@
package com.gitblit.tests;



import static org.junit.Assert.assertFalse;

import static org.junit.Assert.assertTrue;



import java.io.BufferedWriter;

import java.io.File;

import java.io.FileOutputStream;

import java.io.OutputStreamWriter;

import java.text.MessageFormat;

import java.util.Date;

import java.util.concurrent.Executors;

import java.util.concurrent.atomic.AtomicBoolean;



import org.eclipse.jgit.api.CloneCommand;

import org.eclipse.jgit.api.Git;

@@ -16,58 +19,95 @@
import org.junit.BeforeClass;

import org.junit.Test;



import com.gitblit.GitBlitServer;

import com.gitblit.Constants.AccessRestrictionType;

import com.gitblit.GitBlit;

import com.gitblit.models.RepositoryModel;



public class GitServletTest {



   File folder = new File(GitBlitSuite.REPOSITORIES, "working/ticgit");

   static File ticgitFolder = new File(GitBlitSuite.REPOSITORIES, "working/ticgit");

	
   static File ticgit2Folder = new File(GitBlitSuite.REPOSITORIES, "working/ticgit2");



   static int port = 8180;

   static File jgitFolder = new File(GitBlitSuite.REPOSITORIES, "working/jgit");



   static int shutdownPort = 8181;

   String url = GitBlitSuite.url;

   String account = GitBlitSuite.account;

   String password = GitBlitSuite.password;



   private static final AtomicBoolean started = new AtomicBoolean(false);



   @BeforeClass

   public static void startGitblit() throws Exception {

      // Start a Gitblit instance

      Executors.newSingleThreadExecutor().execute(new Runnable() {

         public void run() {

            GitBlitServer.main("--httpPort", "" + port, "--httpsPort", "0", "--shutdownPort",

                  "" + shutdownPort, "--repositoriesFolder",

                  "\"" + GitBlitSuite.REPOSITORIES.getAbsolutePath() + "\"", "--userService",

                  "distrib/users.properties");

         }

      });



      // Wait a few seconds for it to be running

      Thread.sleep(2500);

      deleteWorkingFolders();

      started.set(GitBlitSuite.startGitblit());

   }



   @AfterClass

   public static void stopGitblit() throws Exception {

      // Stop Gitblit

      GitBlitServer.main("--stop", "--shutdownPort", "" + shutdownPort);



      // Wait a few seconds for it to be running

      Thread.sleep(2500);

      if (started.get()) {

         GitBlitSuite.stopGitblit();

      }

      deleteWorkingFolders();

   }

	
   private static void deleteWorkingFolders() throws Exception {

      if (ticgitFolder.exists()) {

         FileUtils.delete(ticgitFolder, FileUtils.RECURSIVE);

      }

      if (ticgit2Folder.exists()) {

         FileUtils.delete(ticgit2Folder, FileUtils.RECURSIVE);

      }

      if (jgitFolder.exists()) {

         FileUtils.delete(jgitFolder, FileUtils.RECURSIVE);

      }

   }



   @Test

   public void testClone() throws Exception {

      if (folder.exists()) {

         FileUtils.delete(folder, FileUtils.RECURSIVE);

      }

      CloneCommand clone = Git.cloneRepository();

      clone.setURI(MessageFormat.format("http://localhost:{0,number,#}/git/ticgit.git", port));

      clone.setDirectory(folder);

      clone.setURI(MessageFormat.format("{0}/git/ticgit.git", url));

      clone.setDirectory(ticgitFolder);

      clone.setBare(false);

      clone.setCloneAllBranches(true);

      clone.call();

      clone.setCredentialsProvider(new UsernamePasswordCredentialsProvider(account, password));

      close(clone.call());		
      assertTrue(true);

   }



   @Test

   public void testAnonymousCommit() throws Exception {

      Git git = Git.open(folder);

      File file = new File(folder, "TODO");

   public void testBogusLoginClone() throws Exception {

      // restrict repository access

      RepositoryModel model = GitBlit.self().getRepositoryModel("ticgit.git");

      model.accessRestriction = AccessRestrictionType.CLONE;

      GitBlit.self().updateRepositoryModel(model.name, model, false);



      // delete any existing working folder		
      boolean cloned = false;

      try {

         CloneCommand clone = Git.cloneRepository();

         clone.setURI(MessageFormat.format("{0}/git/ticgit.git", url));

         clone.setDirectory(ticgit2Folder);

         clone.setBare(false);

         clone.setCloneAllBranches(true);

         clone.setCredentialsProvider(new UsernamePasswordCredentialsProvider("bogus", "bogus"));

         close(clone.call());

         cloned = true;

      } catch (Exception e) {

         // swallow the exception which we expect

      }



      // restore anonymous repository access

      model.accessRestriction = AccessRestrictionType.NONE;

      GitBlit.self().updateRepositoryModel(model.name, model, false);



      assertFalse("Bogus login cloned a repository?!", cloned);

   }



   @Test

   public void testAnonymousPush() throws Exception {

      Git git = Git.open(ticgitFolder);

      File file = new File(ticgitFolder, "TODO");

      OutputStreamWriter os = new OutputStreamWriter(new FileOutputStream(file, true));

      BufferedWriter w = new BufferedWriter(os);

      w.write("// " + new Date().toString() + "\n");

@@ -75,21 +115,37 @@
      git.add().addFilepattern(file.getName()).call();

      git.commit().setMessage("test commit").call();

      git.push().setPushAll().call();

      git.getRepository().close();

      close(git);

   }



   @Test

   public void testBogusLoginClone() throws Exception {

      File folder = new File(GitBlitSuite.REPOSITORIES, "working/gitblit");

      if (folder.exists()) {

         FileUtils.delete(folder, FileUtils.RECURSIVE);

      }

   public void testSubfolderPush() throws Exception {

      CloneCommand clone = Git.cloneRepository();

      clone.setURI(MessageFormat.format("http://localhost:{0,number,#}/git/gitblit.git", port));

      clone.setDirectory(folder);

      clone.setURI(MessageFormat.format("{0}/git/test/jgit.git", url));

      clone.setDirectory(jgitFolder);

      clone.setBare(false);

      clone.setCloneAllBranches(true);

      clone.setCredentialsProvider(new UsernamePasswordCredentialsProvider("bogus", "bogus"));

      clone.call();

      clone.setCredentialsProvider(new UsernamePasswordCredentialsProvider(account, password));

      close(clone.call());

      assertTrue(true);



      Git git = Git.open(jgitFolder);

      File file = new File(jgitFolder, "TODO");

      OutputStreamWriter os = new OutputStreamWriter(new FileOutputStream(file, true));

      BufferedWriter w = new BufferedWriter(os);

      w.write("// " + new Date().toString() + "\n");

      w.close();

      git.add().addFilepattern(file.getName()).call();

      git.commit().setMessage("test commit").call();

      git.push().setPushAll().call();

      close(git);

   }

	
   private void close(Git git) {

      // really close the repository

      // decrement the use counter to 0

      for (int i = 0; i < 2; i++) {

         git.getRepository().close();

      }

   }

}