Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Prevent test failures for invalid SCP-style URLs in go 1.12 #205

Merged
merged 1 commit into from
Sep 9, 2019
Merged

Prevent test failures for invalid SCP-style URLs in go 1.12 #205

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 1 addition & 7 deletions detect_git_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -41,12 +41,6 @@ func TestGitDetector(t *testing.T) {
"git@github.xyz.com:org/project.git//module/a?ref=test-branch",
"git::ssh://git@github.xyz.com/org/project.git//module/a?ref=test-branch",
},
{
// Using the scp-like form with the ssh:// prefix is invalid, so
// it passes through as-is.
"git::ssh://git@github.xyz.com:org/project.git",
"git::ssh://git@github.xyz.com:org/project.git",
},
{
// Already in the canonical form, so no rewriting required
// When the ssh: protocol is used explicitly, we recognize it as
Expand All @@ -61,7 +55,7 @@ func TestGitDetector(t *testing.T) {
f := new(GitDetector)
ds := []Detector{f}
for _, tc := range cases {
t.Run(tc.Input, func (t *testing.T) {
t.Run(tc.Input, func(t *testing.T) {
output, err := Detect(tc.Input, pwd, ds)
if err != nil {
t.Fatalf("unexpected error: %s", err)
Expand Down
3 changes: 3 additions & 0 deletions get_git.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,6 +37,9 @@ func (g *GitGetter) Get(dst string, u *url.URL) error {
// The port number must be parseable as an integer. If not, the user
// was probably trying to use a scp-style address, in which case the
// ssh:// prefix must be removed to indicate that.
//
// This is not necessary in versions of Go which have patched
// CVE-2019-14809 (e.g. Go 1.12.8+)
if portStr := u.Port(); portStr != "" {
if _, err := strconv.ParseUint(portStr, 10, 16); err != nil {
return fmt.Errorf("invalid port number %q; if using the \"scp-like\" git address scheme where a colon introduces the path instead, remove the ssh:// portion and use just the git:: prefix", portStr)
Expand Down
7 changes: 4 additions & 3 deletions get_git_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -380,7 +380,6 @@ func TestGitGetter_sshExplicitPort(t *testing.T) {
}
}


func TestGitGetter_sshSCPStyleInvalidScheme(t *testing.T) {
if !testHasGit {
t.Skip("git not found, skipping")
Expand Down Expand Up @@ -417,8 +416,10 @@ func TestGitGetter_sshSCPStyleInvalidScheme(t *testing.T) {
t.Fatalf("get succeeded; want error")
}

if got, want := err.Error(), `invalid port number "hashicorp"`; !strings.Contains(got, want) {
t.Fatalf("wrong error\ngot: %s\nwant: %s", got, want)
got := err.Error()
want1, want2 := `invalid source string`, `invalid port number "hashicorp"`
if !(strings.Contains(got, want1) || strings.Contains(got, want2)) {
t.Fatalf("wrong error\ngot: %s\nwant: %q or %q", got, want1, want2)
}
}

Expand Down