mirror of
https://codeberg.org/forgejo/forgejo.git
synced 2026-07-18 23:47:50 +00:00
408572dd35
This PR pertains to the client-side validation of the Website input on user, repo, and org profiles. #12962 extends `[service].VALID_SITE_URL_SCHEMES` to cover Website fields on repo and org profiles, where before that config key only applied to the one on user profiles. If that change merges, it will then be possible to construct an HTML [`pattern`](https://developer.mozilla.org/docs/Web/HTML/Reference/Elements/input#pattern) attribute for general use on any Website form input that the server validates this way, thus enabling browsers to catch errors early relating to URL scheme confusion. This PR (1) introduces such a `pattern` attribute, and (2) adds a new UI note to make clear to users which URL schemes are permitted. This change helps explain the browser's otherwise cryptic error messages regarding pattern mismatch, while also letting users know what URI schemes the Forgejo instance supports as Website links (e.g. gemini:// URLs).  This MUST NOT merge before #12962. To do so would introduce a regression wherein the UI may suggest and validate a different set of allowed URL schemes than the server actually permits. See also #5519 Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/12991 Reviewed-by: 0ko <0ko@noreply.codeberg.org>
63 lines
2.2 KiB
Go
63 lines
2.2 KiB
Go
// Copyright 2026 The Forgejo Authors. All rights reserved.
|
|
// SPDX-License-Identifier: GPL-3.0-or-later
|
|
|
|
package integration
|
|
|
|
import (
|
|
"net/http"
|
|
"strings"
|
|
"testing"
|
|
|
|
"forgejo.org/modules/setting"
|
|
"forgejo.org/modules/test"
|
|
"forgejo.org/tests"
|
|
|
|
"github.com/PuerkitoBio/goquery"
|
|
"github.com/stretchr/testify/assert"
|
|
)
|
|
|
|
func TestWebsitePattern(t *testing.T) {
|
|
defer tests.PrepareTestEnv(t)()
|
|
|
|
session := loginUser(t, "user1")
|
|
|
|
cases := [][2]string{
|
|
// these routes have a "Website" form input whose validation changes based on `[service].VALID_SITE_URL_SCHEMES`:
|
|
{"admin user edit", "/admin/users/2/edit"},
|
|
{"org settings", "/org/org3/settings"},
|
|
{"repo settings", "/user2/repo1/settings"},
|
|
{"user own settings", "/user/settings"},
|
|
}
|
|
for _, testCase := range cases {
|
|
title := testCase[0]
|
|
urlStr := testCase[1]
|
|
|
|
t.Run(title+" form under default schemes", func(t *testing.T) {
|
|
defer tests.PrintCurrentTest(t)()
|
|
|
|
// Website pattern and note should contain only http(s)
|
|
req := NewRequest(t, "GET", urlStr)
|
|
resp := session.MakeRequest(t, req, http.StatusOK)
|
|
doc := NewHTMLParser(t, resp.Body)
|
|
doc.AssertAttrEqual(t, "input[type=url][name=website]", "pattern", `(http|https)://.+`)
|
|
doc.AssertElementPredicate(t, "input[type=url][name=website] + .help", func(element *goquery.Selection) {
|
|
assert.Equal(t, "Allowed URL schemes include: http, https", strings.TrimSpace(element.Text()))
|
|
})
|
|
})
|
|
|
|
t.Run(title+" form under custom schemes", func(t *testing.T) {
|
|
defer tests.PrintCurrentTest(t)()
|
|
defer test.MockProtect(&setting.Service.ValidSiteURLSchemes)()
|
|
setting.Service.ValidSiteURLSchemes = append(setting.Service.ValidSiteURLSchemes, "h3")
|
|
|
|
// Website pattern and note should contain only http(s) and h3
|
|
req := NewRequest(t, "GET", urlStr)
|
|
resp := session.MakeRequest(t, req, http.StatusOK)
|
|
doc := NewHTMLParser(t, resp.Body)
|
|
doc.AssertAttrEqual(t, "input[type=url][name=website]", "pattern", `(http|https|h3)://.+`)
|
|
doc.AssertElementPredicate(t, "input[type=url][name=website] + .help", func(element *goquery.Selection) {
|
|
assert.Equal(t, "Allowed URL schemes include: http, https, h3", strings.TrimSpace(element.Text()))
|
|
})
|
|
})
|
|
}
|
|
}
|