@@ -14,84 +14,60 @@ import (
1414 "github.com/stretchr/testify/assert"
1515)
1616
17- func TestDownloadByID (t * testing.T ) {
17+ func TestDownloadRepoContent (t * testing.T ) {
1818 defer tests .PrepareTestEnv (t )()
1919
2020 session := loginUser (t , "user2" )
2121
22- // Request raw blob
23- req := NewRequest (t , "GET" , "/user2/repo1/raw/blob/4b4851ad51df6a7d9f25c979345979eaeb5b349f" )
24- resp := session .MakeRequest (t , req , http .StatusOK )
25-
26- assert .Equal (t , "# repo1\n \n Description for repo1" , resp .Body .String ())
27- }
28-
29- func TestDownloadByIDForSVGUsesSecureHeaders (t * testing.T ) {
30- defer tests .PrepareTestEnv (t )()
31-
32- session := loginUser (t , "user2" )
33-
34- // Request raw blob
35- req := NewRequest (t , "GET" , "/user2/repo2/raw/blob/6395b68e1feebb1e4c657b4f9f6ba2676a283c0b" )
36- resp := session .MakeRequest (t , req , http .StatusOK )
37-
38- assert .Equal (t , "default-src 'none'; style-src 'unsafe-inline'; sandbox" , resp .Header ().Get ("Content-Security-Policy" ))
39- assert .Equal (t , "image/svg+xml" , resp .Header ().Get ("Content-Type" ))
40- assert .Equal (t , "nosniff" , resp .Header ().Get ("X-Content-Type-Options" ))
41- }
42-
43- func TestDownloadByIDMedia (t * testing.T ) {
44- defer tests .PrepareTestEnv (t )()
45-
46- session := loginUser (t , "user2" )
47-
48- // Request raw blob
49- req := NewRequest (t , "GET" , "/user2/repo1/media/blob/4b4851ad51df6a7d9f25c979345979eaeb5b349f" )
50- resp := session .MakeRequest (t , req , http .StatusOK )
51-
52- assert .Equal (t , "# repo1\n \n Description for repo1" , resp .Body .String ())
53- }
54-
55- func TestDownloadByIDMediaForSVGUsesSecureHeaders (t * testing.T ) {
56- defer tests .PrepareTestEnv (t )()
57-
58- session := loginUser (t , "user2" )
59-
60- // Request raw blob
61- req := NewRequest (t , "GET" , "/user2/repo2/media/blob/6395b68e1feebb1e4c657b4f9f6ba2676a283c0b" )
62- resp := session .MakeRequest (t , req , http .StatusOK )
63-
64- assert .Equal (t , "default-src 'none'; style-src 'unsafe-inline'; sandbox" , resp .Header ().Get ("Content-Security-Policy" ))
65- assert .Equal (t , "image/svg+xml" , resp .Header ().Get ("Content-Type" ))
66- assert .Equal (t , "nosniff" , resp .Header ().Get ("X-Content-Type-Options" ))
67- }
68-
69- func TestDownloadRawTextFileWithoutMimeTypeMapping (t * testing.T ) {
70- defer tests .PrepareTestEnv (t )()
71-
72- session := loginUser (t , "user2" )
73-
74- req := NewRequest (t , "GET" , "/user2/repo2/raw/branch/master/test.xml" )
75- resp := session .MakeRequest (t , req , http .StatusOK )
76-
77- assert .Equal (t , "text/plain; charset=utf-8" , resp .Header ().Get ("Content-Type" ))
78- }
79-
80- func TestDownloadRawTextFileWithMimeTypeMapping (t * testing.T ) {
81- defer tests .PrepareTestEnv (t )()
82- defer test .MockVariableValue (& setting .MimeTypeMap )()
83-
84- setting .MimeTypeMap .Enabled = true
85- session := loginUser (t , "user2" )
86-
87- setting .MimeTypeMap .Map [".xml" ] = "text/xml"
88- req := NewRequest (t , "GET" , "/user2/repo2/raw/branch/master/test.xml" )
89- resp := session .MakeRequest (t , req , http .StatusOK )
90- assert .Equal (t , "inline; filename=test.xml" , resp .Header ().Get ("Content-Disposition" ))
91- assert .Equal (t , "text/xml; charset=utf-8" , resp .Header ().Get ("Content-Type" ))
92-
93- setting .MimeTypeMap .Map [".xml" ] = "application/xml"
94- req = NewRequest (t , "GET" , "/user2/repo2/raw/branch/master/test.xml" )
95- resp = session .MakeRequest (t , req , http .StatusOK )
96- assert .Equal (t , "application/xml" , resp .Header ().Get ("Content-Type" ))
22+ t .Run ("RawBlob" , func (t * testing.T ) {
23+ req := NewRequest (t , "GET" , "/user2/repo1/raw/blob/4b4851ad51df6a7d9f25c979345979eaeb5b349f" )
24+ resp := session .MakeRequest (t , req , http .StatusOK )
25+ assert .Equal (t , "# repo1\n \n Description for repo1" , resp .Body .String ())
26+ })
27+
28+ t .Run ("SVGUsesSecureHeaders" , func (t * testing.T ) {
29+ req := NewRequest (t , "GET" , "/user2/repo2/raw/blob/6395b68e1feebb1e4c657b4f9f6ba2676a283c0b" )
30+ resp := session .MakeRequest (t , req , http .StatusOK )
31+ assert .Equal (t , "default-src 'none'; style-src 'unsafe-inline'; sandbox" , resp .Header ().Get ("Content-Security-Policy" ))
32+ assert .Equal (t , "image/svg+xml" , resp .Header ().Get ("Content-Type" ))
33+ assert .Equal (t , "nosniff" , resp .Header ().Get ("X-Content-Type-Options" ))
34+ })
35+
36+ t .Run ("MediaBlob" , func (t * testing.T ) {
37+ req := NewRequest (t , "GET" , "/user2/repo1/media/blob/4b4851ad51df6a7d9f25c979345979eaeb5b349f" )
38+ resp := session .MakeRequest (t , req , http .StatusOK )
39+ assert .Equal (t , "# repo1\n \n Description for repo1" , resp .Body .String ())
40+ })
41+
42+ t .Run ("MediaSVGUsesSecureHeaders" , func (t * testing.T ) {
43+ req := NewRequest (t , "GET" , "/user2/repo2/media/blob/6395b68e1feebb1e4c657b4f9f6ba2676a283c0b" )
44+ resp := session .MakeRequest (t , req , http .StatusOK )
45+ assert .Equal (t , "default-src 'none'; style-src 'unsafe-inline'; sandbox" , resp .Header ().Get ("Content-Security-Policy" ))
46+ assert .Equal (t , "image/svg+xml" , resp .Header ().Get ("Content-Type" ))
47+ assert .Equal (t , "nosniff" , resp .Header ().Get ("X-Content-Type-Options" ))
48+ })
49+
50+ t .Run ("MimeTypeMap" , func (t * testing.T ) {
51+ req := NewRequest (t , "GET" , "/user2/repo2/raw/branch/master/test.xml" )
52+ resp := session .MakeRequest (t , req , http .StatusOK )
53+ // although the file is a valid XML file, it is served as "text/plain" to avoid site content spamming (the same to "text/html" files)
54+ assert .Equal (t , "text/plain; charset=utf-8" , resp .Header ().Get ("Content-Type" ))
55+
56+ defer tests .PrepareTestEnv (t )()
57+ defer test .MockVariableValue (& setting .MimeTypeMap )()
58+ setting .MimeTypeMap .Enabled = true
59+
60+ setting .MimeTypeMap .Map [".xml" ] = "text/xml"
61+ req = NewRequest (t , "GET" , "/user2/repo2/raw/branch/master/test.xml" )
62+ resp = session .MakeRequest (t , req , http .StatusOK )
63+ // respect the mime mapping, and "text/plain" protection isn't used anymore
64+ assert .Equal (t , "text/xml; charset=utf-8" , resp .Header ().Get ("Content-Type" ))
65+ assert .Equal (t , "inline; filename=test.xml" , resp .Header ().Get ("Content-Disposition" ))
66+
67+ setting .MimeTypeMap .Map [".xml" ] = "application/xml"
68+ req = NewRequest (t , "GET" , "/user2/repo2/raw/branch/master/test.xml" )
69+ resp = session .MakeRequest (t , req , http .StatusOK )
70+ // non-text file don't have "charset"
71+ assert .Equal (t , "application/xml" , resp .Header ().Get ("Content-Type" ))
72+ })
9773}
0 commit comments