Skip to content

Conversation

zeripath
Copy link
Contributor

  • The .Use of storageHandler before setting up the template renderer
    causes a panic if there is an error to log.
  • The error passed to ctx.Error in that case may contain sensitive
    information and should not be rendered to the end user. We should
    instead log the error and render a simple error message.
  • There is no handling of missing avatars and this needs a 404. Minio
    errors need to be mapped to standard golang errors such as
    os.ErrNotExist.
  • There is no logging when storage is set up.

Related #13159

Signed-off-by: Andrew Thornton art27@cantab.net

* The `.Use` of storageHandler before setting up the template renderer
causes a panic if there is an error to log.
* The error passed to `ctx.Error` in that case may contain sensitive
information and should not be rendered to the end user. We should
instead log the error and render a simple error message.
* There is no handling of missing avatars and this needs a 404. Minio
errors need to be mapped to standard golang errors such as
os.ErrNotExist.
* There is no logging when storage is set up.

Related go-gitea#13159

Signed-off-by: Andrew Thornton <art27@cantab.net>
@zeripath zeripath added this to the 1.14.0 milestone Oct 15, 2020
@zeripath zeripath changed the title Prevent panics with missing storage Prevent panic on error whilst getting storage Oct 15, 2020
@zeripath
Copy link
Contributor Author

I have not marked this a fixing #13159 because I am uncertain as to the root of their errors. It could simply be that the default location for avatars is now different but I think we looked very carefully at that to prevent that.

Unfortunately there was no logging so we cannot be sure what the configuration is. This PR now adds some logging.

@GiteaBot GiteaBot added the lgtm/need 2 This PR needs two approvals by maintainers to be considered for merging. label Oct 15, 2020
@GiteaBot GiteaBot added lgtm/need 1 This PR needs approval from one additional maintainer to be merged. and removed lgtm/need 2 This PR needs two approvals by maintainers to be considered for merging. labels Oct 15, 2020
@6543 6543 added the type/enhancement An improvement of existing functionality label Oct 15, 2020
@codecov-io
Copy link

codecov-io commented Oct 16, 2020

Codecov Report

Merging #13164 into master will increase coverage by 0.00%.
The diff coverage is 13.33%.

Impacted file tree graph

@@           Coverage Diff           @@
##           master   #13164   +/-   ##
=======================================
  Coverage   42.04%   42.04%           
=======================================
  Files         681      681           
  Lines       75145    75173   +28     
=======================================
+ Hits        31596    31609   +13     
- Misses      38393    38410   +17     
+ Partials     5156     5154    -2     
Impacted Files Coverage Δ
modules/storage/minio.go 1.81% <0.00%> (-0.23%) ⬇️
routers/routes/routes.go 84.87% <6.66%> (-1.10%) ⬇️
modules/storage/local.go 40.74% <100.00%> (+1.11%) ⬆️
modules/storage/storage.go 58.18% <100.00%> (+3.27%) ⬆️
modules/log/event.go 59.90% <0.00%> (-1.89%) ⬇️
services/pull/pull.go 40.78% <0.00%> (-0.50%) ⬇️
modules/git/repo.go 46.70% <0.00%> (+0.50%) ⬆️
services/pull/patch.go 54.54% <0.00%> (+1.70%) ⬆️
services/pull/check.go 51.82% <0.00%> (+2.18%) ⬆️
services/pull/temp_repo.go 29.78% <0.00%> (+3.19%) ⬆️
... and 2 more

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update cb171db...c5d774a. Read the comment docs.

@GiteaBot GiteaBot added lgtm/done This PR has enough approvals to get merged. There are no important open reservations anymore. and removed lgtm/need 1 This PR needs approval from one additional maintainer to be merged. labels Oct 16, 2020
@techknowlogick techknowlogick merged commit 91f2afd into go-gitea:master Oct 16, 2020
@zeripath zeripath deleted the fix-13159-prevent-panics-in-missing-avatars branch October 16, 2020 07:08
@zeripath
Copy link
Contributor Author

Damn damn damn. I got the error conversion incorrect here - this'll teach me for not actually making unit tests!

We should be mostly converting to os.PathError and checking that instead of plain os errors.

@6543
Copy link
Member

6543 commented Oct 16, 2020

@zeripath I think, at this point we can invent a new error strukts ourselve :)

@zeripath
Copy link
Contributor Author

I think if we just use errors.Is(err, os.ErrNotExist) then we can keep the convert very simple.

@zeripath zeripath mentioned this pull request Oct 16, 2020
zeripath added a commit to zeripath/gitea that referenced this pull request Oct 16, 2020
Unfortunately there was a mistake in go-gitea#13164 which fails to handle
os.PathError wrapping an os.ErrNotExist

Signed-off-by: Andrew Thornton <art27@cantab.net>
ivanvc added a commit to ivanvc/gitea that referenced this pull request Oct 16, 2020
…ments-in-pull-request-label-style

* origin/master:
  [skip ci] Updated translations via Crowdin
  Fix diff skipping lines (go-gitea#13154)
  Update go-version v1.2.3 -> v1.2.4 (go-gitea#13169)
  Vendor Update Go Libs (go-gitea#13166)
  Prevent panics with missing storage (go-gitea#13164)
  Improve users management through the CLI (go-gitea#6001) (go-gitea#10492)
  Change order of possible-owner organizations to alphabetical (go-gitea#13160)
  Slightly simplify the queue settings code to help reduce the risk of problems (go-gitea#12976)
  [Vendor] Update go-ldap to v3.2.4 (go-gitea#13163)
  [skip ci] Updated translations via Crowdin
  Update external-renderers.en-us.md (go-gitea#13165)
@zeripath zeripath mentioned this pull request Oct 17, 2020
techknowlogick added a commit that referenced this pull request Oct 18, 2020
Unfortunately there was a mistake in #13164 which fails to handle
os.PathError wrapping an os.ErrNotExist

Signed-off-by: Andrew Thornton <art27@cantab.net>

Co-authored-by: techknowlogick <techknowlogick@gitea.io>
techknowlogick added a commit to techknowlogick/gitea that referenced this pull request Oct 18, 2020
…ea#13178)

Unfortunately there was a mistake in go-gitea#13164 which fails to handle
os.PathError wrapping an os.ErrNotExist

Signed-off-by: Andrew Thornton <art27@cantab.net>

Co-authored-by: techknowlogick <techknowlogick@gitea.io>
@techknowlogick techknowlogick added the backport/done All backports for this PR have been created label Oct 18, 2020
@techknowlogick
Copy link
Member

Backport sent. It is #13193

zeripath added a commit that referenced this pull request Oct 18, 2020
#13193)

Unfortunately there was a mistake in #13164 which fails to handle
os.PathError wrapping an os.ErrNotExist

Signed-off-by: Andrew Thornton <art27@cantab.net>

Co-authored-by: techknowlogick <techknowlogick@gitea.io>
Co-authored-by: zeripath <art27@cantab.net>
zeripath added a commit to zeripath/gitea that referenced this pull request Oct 25, 2020
Signed-off-by: Andrew Thornton <art27@cantab.net>
techknowlogick pushed a commit that referenced this pull request Oct 26, 2020
* Fix Storage mapping (#13297)

Backport #13297

This PR fixes several bugs in setting storage

* The default STORAGE_TYPE should be the provided type.
* The Storage config should be passed in to NewStorage as a pointer - otherwise the Mappable interface function MapTo will not be found
* There was a bug in the MapTo function.

Fix #13286

Signed-off-by: Andrew Thornton <art27@cantab.net>

* add missing changes from backport #13164

Signed-off-by: Andrew Thornton <art27@cantab.net>

Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
@go-gitea go-gitea locked and limited conversation to collaborators Nov 24, 2020
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
backport/done All backports for this PR have been created lgtm/done This PR has enough approvals to get merged. There are no important open reservations anymore. type/enhancement An improvement of existing functionality
Projects
None yet
Development

Successfully merging this pull request may close these issues.

7 participants