This is an automated email from the ASF dual-hosted git repository.
asf-gitbox-commits pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/allura.git
The following commit(s) were added to refs/heads/master by this push:
new 82a94e6ea fix scheme/protocol checking in clone task
82a94e6ea is described below
commit 82a94e6ea07382390bb4f4e0962afd920758fd58
Author: Dave Brondsema <[email protected]>
AuthorDate: Mon May 18 16:13:21 2026 -0400
fix scheme/protocol checking in clone task
---
Allura/allura/lib/validators.py | 11 ++++++++++-
Allura/allura/tasks/repo_tasks.py | 3 ++-
ForgeGit/forgegit/git_main.py | 2 +-
ForgeSVN/forgesvn/widgets.py | 15 ++-------------
4 files changed, 15 insertions(+), 16 deletions(-)
diff --git a/Allura/allura/lib/validators.py b/Allura/allura/lib/validators.py
index 95e43c219..814fa920b 100644
--- a/Allura/allura/lib/validators.py
+++ b/Allura/allura/lib/validators.py
@@ -17,6 +17,7 @@
import json
import re
+from collections.abc import Collection
import tg
from bson import ObjectId
@@ -37,7 +38,7 @@ class URL(fev.URL):
require_tld = False
url_re = re.compile(r'''
- ^(http|https)://
+ ^([a-z+]+)://
(?:[%:\w]*@)? # authenticator
(?: # ip or domain
(?P<ip>(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?))|
@@ -52,6 +53,11 @@ class URL(fev.URL):
class NonPrivateUrl(URL):
+
+ def __init__(self, enforce_schemes: Collection[str] | None = ('http',
'https'), *args, **kw):
+ super().__init__(*args, **kw)
+ self.enforce_schemes = enforce_schemes
+
# prevents private IPs
def _convert_to_python(self, value, state):
value = super()._convert_to_python(value, state)
@@ -60,6 +66,9 @@ def _convert_to_python(self, value, state):
return value
url_components = urlsplit(value)
+ if self.enforce_schemes and url_components.scheme not in
self.enforce_schemes:
+ raise fev.Invalid("Invalid URL scheme.", value, state)
+
try:
addr_info = socket.getaddrinfo(url_components.hostname, None)
except socket.gaierror:
diff --git a/Allura/allura/tasks/repo_tasks.py
b/Allura/allura/tasks/repo_tasks.py
index aa86ebc01..6b61bfde7 100644
--- a/Allura/allura/tasks/repo_tasks.py
+++ b/Allura/allura/tasks/repo_tasks.py
@@ -39,7 +39,8 @@ def init(**kwargs):
def clone(cloned_from_path, cloned_from_name, cloned_from_url):
from allura import model as M
try:
- v.NonPrivateUrl().to_python(cloned_from_url)
+ # could be git:// svn+ssh:// many things for scheme
+ v.NonPrivateUrl(enforce_schemes=None).to_python(cloned_from_url)
c.app.repo.init_as_clone(
cloned_from_path,
diff --git a/ForgeGit/forgegit/git_main.py b/ForgeGit/forgegit/git_main.py
index 12889c0ef..ddb4013d3 100644
--- a/ForgeGit/forgegit/git_main.py
+++ b/ForgeGit/forgegit/git_main.py
@@ -98,7 +98,7 @@ def install(self, project):
allura.tasks.repo_tasks.clone.post(
cloned_from_path=cloned_from.full_fs_path,
cloned_from_name=cloned_from.app.config.script_name(),
- cloned_from_url=cloned_from.full_fs_path)
+ cloned_from_url=cloned_from.clone_url_first(anon=True))
elif init_from_url or init_from_path:
allura.tasks.repo_tasks.clone.post(
cloned_from_path=init_from_path,
diff --git a/ForgeSVN/forgesvn/widgets.py b/ForgeSVN/forgesvn/widgets.py
index eb938411a..e4e76734a 100644
--- a/ForgeSVN/forgesvn/widgets.py
+++ b/ForgeSVN/forgesvn/widgets.py
@@ -26,19 +26,8 @@
class ValidateSvnUrl(validators.NonPrivateUrl):
- url_re = re.compile(r'''
- ^(http|https|svn)://
- (?:[%:\w]*@)? # authenticator
- (?: # ip or domain
-
(?P<ip>(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?))|
- (?P<domain>[a-z0-9][a-z0-9\-]{,62}\.)* # subdomain
- (?P<tld>[a-z]{2,63}|xn--[a-z0-9\-]{2,59}) # top level domain
- )
- (?::[0-9]{1,5})? # port
- # files/delims/etc
- (?P<path>/[a-z0-9\-\._~:/\?#\[\]@!%\$&\'\(\)\*\+,;=]*)?
- $
- ''', re.I | re.VERBOSE)
+ def __init__(self, *args, **kw):
+ super().__init__(*args, enforce_schemes=['svn', 'http', 'https'], **kw)
def _convert_to_python(self, value, state):
value = super()._convert_to_python(value, state)
