admin
e4afba3416
giteabot backport / giteabot (push) Canceled after 0s
giteabot / giteabot (push) Canceled after 0s
release-nightly / nightly-binary (push) Canceled after 0s
release-nightly / nightly-container (push) Canceled after 0s
cache-seeder / gobuild (push) Canceled after 0s
cache-seeder / lint (bindata, lint-backend) (push) Canceled after 0s
release-nightly-snapcraft / build-and-publish (push) Canceled after 0s
Includes direct password setup links in registration emails. Assisted-by: Codex:GPT-5
38 lines
1.2 KiB
Go
38 lines
1.2 KiB
Go
// Copyright 2026 The Gitea Authors. All rights reserved.
|
|
// SPDX-License-Identifier: MIT
|
|
|
|
package private
|
|
|
|
import (
|
|
"testing"
|
|
|
|
"gitea.dev/modules/setting"
|
|
|
|
"github.com/stretchr/testify/assert"
|
|
)
|
|
|
|
func TestInternalAPIConnectionIsLocal(t *testing.T) {
|
|
cases := []struct {
|
|
name string
|
|
protocol setting.Scheme
|
|
localURL string
|
|
want bool
|
|
}{
|
|
// HTTPUnix always dials the unix socket (a local target), whatever LOCAL_ROOT_URL says
|
|
{"unix socket", setting.HTTPUnix, "https://gitea.example.com/", true},
|
|
{"localhost", setting.HTTP, "http://localhost:3000/", true},
|
|
{"loopback ipv4", setting.HTTPS, "https://127.0.0.1:3000/", true},
|
|
{"loopback ipv6", setting.HTTPS, "https://[::1]:3000/", true},
|
|
// a non-loopback LOCAL_ROOT_URL is a real network hop and must be verified
|
|
{"remote host", setting.HTTPS, "https://gitea.internal:443/", false},
|
|
{"remote ip", setting.HTTPS, "https://10.0.0.5:3000/", false},
|
|
// an unparseable LOCAL_ROOT_URL is a hard misconfiguration; fail closed to verification
|
|
{"invalid url", setting.HTTPS, "://bad", false},
|
|
}
|
|
for _, c := range cases {
|
|
t.Run(c.name, func(t *testing.T) {
|
|
assert.Equal(t, c.want, internalAPIConnectionIsLocal(c.protocol, c.localURL))
|
|
})
|
|
}
|
|
}
|