vole
Clone
Read only, no credentials:
https://rodent.software/git/vole.git
Write over SSH with a registered key:
git clone ssh://git@0.0.0.0:2222/vole.git
A free and open-source forge that lives in your Git repo.
Merge change request 01M70WES5ZZDJ6RP226WB11BBZ: Let people rename and remove their own passkeys
keenan · 24m ago
4b8c9e1d
| 1 | package server |
| 2 | |
| 3 | // The LFS batch response tells a git-lfs client where to download from. That href |
| 4 | // is followed by the client, so it must not be a host the caller chose. |
| 5 | |
| 6 | import ( |
| 7 | "net/http/httptest" |
| 8 | "strings" |
| 9 | "testing" |
| 10 | |
| 11 | "rodent.software/vole/forge/config" |
| 12 | ) |
| 13 | |
| 14 | func TestLFSObjectBasePrefersTheConfiguredOrigin(t *testing.T) { |
| 15 | t.Parallel() |
| 16 | s := &Server{Cfg: &config.Config{PublicURL: "https://forge.example.com"}} |
| 17 | r := httptest.NewRequest("POST", "/demo.git"+objectShard+"objects/batch", nil) |
| 18 | r.Host = "evil.example" |
| 19 | r.Header.Set("X-Forwarded-Proto", "http") |
| 20 | |
| 21 | got := s.lfsObjectBase(r, "demo") |
| 22 | if !strings.HasPrefix(got, "https://forge.example.com/demo.git") { |
| 23 | t.Fatalf("lfsObjectBase = %q, want the configured origin", got) |
| 24 | } |
| 25 | if strings.Contains(got, "evil.example") { |
| 26 | t.Fatalf("lfsObjectBase followed the request Host: %q", got) |
| 27 | } |
| 28 | } |
| 29 | |
| 30 | func TestLFSObjectBaseHonoursForwardedHeadersOnlyBehindAProxy(t *testing.T) { |
| 31 | t.Parallel() |
| 32 | r := httptest.NewRequest("POST", "/demo.git"+objectShard+"objects/batch", nil) |
| 33 | r.Host = "127.0.0.1:8080" |
| 34 | r.Header.Set("X-Forwarded-Proto", "https") |
| 35 | |
| 36 | s := &Server{Cfg: &config.Config{}} |
| 37 | if got := s.lfsObjectBase(r, "demo"); !strings.HasPrefix(got, "http://127.0.0.1:8080/") { |
| 38 | t.Fatalf("without a declared proxy lfsObjectBase = %q", got) |
| 39 | } |
| 40 | s = &Server{Cfg: &config.Config{GitHTTPClientIPHeader: "X-Forwarded-For"}} |
| 41 | if got := s.lfsObjectBase(r, "demo"); !strings.HasPrefix(got, "https://127.0.0.1:8080/") { |
| 42 | t.Fatalf("behind a declared proxy lfsObjectBase = %q", got) |
| 43 | } |
| 44 | } |
| 45 |