mirror of
https://gitea.com/gitea/runner.git
synced 2026-08-27 14:27:46 +00:00
12dc9d26a2
Fixes 51 bugs discovered via comparison with `actions/runner`. Every fix has test coverage.
### Secrets
- A short secret registered no shifted-base64 form, so `base64("user:$TOKEN")` printed in the clear
- Encoded forms came only from the whole trimmed value, missing padded and per-line spellings
- Masks split only on `\n`, so `::add-mask::a%0Db` registered neither half
- Adds XML, expression-string and quote-trimming encoders
### Workflow commands
- Split at the last `::` or `]` rather than the first, so `::add-mask::a::b` registered no mask
- A command on the last line without a newline was ignored, and `::ADD-MASK::` did nothing
- `##[...]` did not decode `%3B`/`%5D`, properties lost anything after a second `=`
- `$GITHUB_ENV` and `::set-env::` now refuse `NODE_OPTIONS`
### Status
- `continue-on-error` reported failed, a cancelled job reported success, an `if:` error reported cancelled
- File commands ran after `continue-on-error`, failing the job while the step stayed green
- A bad job output aborted the whole run instead of that job
### Steps and actions
- `${{ matrix.* }}` and `${{ strategy.* }}` were empty inside composite actions
- Composite inputs leaked into nested actions as `INPUT_*`, `with:` matched case-sensitively, `pre` failures were dropped
- Docker actions dropped `runs.env` when the caller passed `with: args:`, and caller `args`/`entrypoint` beat the manifest
- An implicit shell ran with `pipefail`, a `shell:` without `{0}` passed without running
- `container.env` overrode job env and every `$GITHUB_ENV` write, heredocs lost leading blank lines, `$GITHUB_PATH` was not BOM-decoded
Written by Claude Opus 5.
Reviewed-on: https://gitea.com/gitea/runner/pulls/1194
Reviewed-by: bircni <bircni@icloud.com>
Co-authored-by: silverwind <me@silverwind.io>
140 lines
4.6 KiB
Go
140 lines
4.6 KiB
Go
// Copyright 2026 The Gitea Authors. All rights reserved.
|
|
// SPDX-License-Identifier: MIT
|
|
|
|
package container
|
|
|
|
import (
|
|
"bufio"
|
|
"context"
|
|
"os"
|
|
"path/filepath"
|
|
"strings"
|
|
"testing"
|
|
|
|
"github.com/stretchr/testify/assert"
|
|
"github.com/stretchr/testify/require"
|
|
"golang.org/x/text/encoding"
|
|
"golang.org/x/text/encoding/unicode"
|
|
)
|
|
|
|
func newTestHostEnv(t *testing.T) (*HostEnvironment, string) {
|
|
t.Helper()
|
|
e := &HostEnvironment{Path: t.TempDir()}
|
|
return e, filepath.Join(e.Path, "envfile")
|
|
}
|
|
|
|
func TestParseEnvFileSingleLine(t *testing.T) {
|
|
e, envPath := newTestHostEnv(t)
|
|
require.NoError(t, os.WriteFile(envPath, []byte("FOO=bar\nBAZ=qux\n"), 0o600))
|
|
|
|
env := map[string]string{}
|
|
require.NoError(t, parseEnvFile(e, envPath, &env)(context.Background()))
|
|
assert.Equal(t, "bar", env["FOO"])
|
|
assert.Equal(t, "qux", env["BAZ"])
|
|
}
|
|
|
|
func TestParseEnvFileMultiLine(t *testing.T) {
|
|
e, envPath := newTestHostEnv(t)
|
|
content := "FOO<<EOF\nline1\nline2\nEOF\n"
|
|
require.NoError(t, os.WriteFile(envPath, []byte(content), 0o600))
|
|
|
|
env := map[string]string{}
|
|
require.NoError(t, parseEnvFile(e, envPath, &env)(context.Background()))
|
|
assert.Equal(t, "line1\nline2", env["FOO"])
|
|
}
|
|
|
|
func TestParseEnvFileLargeValueWithinLimit(t *testing.T) {
|
|
e, envPath := newTestHostEnv(t)
|
|
big := strings.Repeat("x", 2*1024*1024)
|
|
content := "FOO<<EOF\n" + big + "\nEOF\n"
|
|
require.NoError(t, os.WriteFile(envPath, []byte(content), 0o600))
|
|
|
|
env := map[string]string{}
|
|
require.NoError(t, parseEnvFile(e, envPath, &env)(context.Background()))
|
|
assert.Equal(t, big, env["FOO"])
|
|
}
|
|
|
|
func TestParseEnvFileLineExceedsBufferReportsScannerError(t *testing.T) {
|
|
e, envPath := newTestHostEnv(t)
|
|
tooBig := strings.Repeat("x", 17*1024*1024) // over the 16 MiB cap
|
|
content := "FOO<<EOF\n" + tooBig + "\nEOF\n"
|
|
require.NoError(t, os.WriteFile(envPath, []byte(content), 0o600))
|
|
|
|
env := map[string]string{}
|
|
err := parseEnvFile(e, envPath, &env)(context.Background())
|
|
require.ErrorIs(t, err, bufio.ErrTooLong)
|
|
assert.Contains(t, err.Error(), "reading env file")
|
|
}
|
|
|
|
// Regression test: a blank line used to fail the job at "Complete Job", after
|
|
// every step had already been recorded as successful.
|
|
func TestParseEnvFileBlankLines(t *testing.T) {
|
|
e, envPath := newTestHostEnv(t)
|
|
require.NoError(t, os.WriteFile(envPath, []byte("\nFOO=bar\n\n \nBAZ=qux\n\n"), 0o600))
|
|
|
|
env := map[string]string{}
|
|
require.NoError(t, parseEnvFile(e, envPath, &env)(context.Background()))
|
|
assert.Equal(t, "bar", env["FOO"])
|
|
assert.Equal(t, "qux", env["BAZ"])
|
|
}
|
|
|
|
// blank lines inside a heredoc value are content, not separators
|
|
func TestParseEnvFileMultiLineKeepsBlankLines(t *testing.T) {
|
|
e, envPath := newTestHostEnv(t)
|
|
require.NoError(t, os.WriteFile(envPath, []byte("FOO<<EOF\nline1\n\nline2\nEOF\n"), 0o600))
|
|
|
|
env := map[string]string{}
|
|
require.NoError(t, parseEnvFile(e, envPath, &env)(context.Background()))
|
|
assert.Equal(t, "line1\n\nline2", env["FOO"])
|
|
|
|
require.NoError(t, os.WriteFile(envPath, []byte("FOO<<EOF\n\nline2\nEOF\n"), 0o600))
|
|
env = map[string]string{}
|
|
require.NoError(t, parseEnvFile(e, envPath, &env)(context.Background()))
|
|
assert.Equal(t, "\nline2", env["FOO"])
|
|
}
|
|
|
|
func TestParseEnvFileUTF8BOM(t *testing.T) {
|
|
e, envPath := newTestHostEnv(t)
|
|
content := append([]byte{0xEF, 0xBB, 0xBF}, []byte("FOO=bar\n")...)
|
|
require.NoError(t, os.WriteFile(envPath, content, 0o600))
|
|
|
|
env := map[string]string{}
|
|
require.NoError(t, parseEnvFile(e, envPath, &env)(context.Background()))
|
|
assert.Equal(t, "bar", env["FOO"])
|
|
}
|
|
|
|
// Windows host mode: PowerShell 5.1 redirection writes UTF-16, which used to be
|
|
// unrecognisable as KEY=VALUE, so the writes were silently ignored.
|
|
func TestParseEnvFileUTF16(t *testing.T) {
|
|
tests := []struct {
|
|
name string
|
|
encoder *encoding.Encoder
|
|
}{
|
|
{"little endian", unicode.UTF16(unicode.LittleEndian, unicode.UseBOM).NewEncoder()},
|
|
{"big endian", unicode.UTF16(unicode.BigEndian, unicode.UseBOM).NewEncoder()},
|
|
}
|
|
for _, tt := range tests {
|
|
t.Run(tt.name, func(t *testing.T) {
|
|
e, envPath := newTestHostEnv(t)
|
|
content, err := tt.encoder.Bytes([]byte("FOO=bar\r\nMULTI<<EOF\r\nline1\r\nEOF\r\n"))
|
|
require.NoError(t, err)
|
|
require.NoError(t, os.WriteFile(envPath, content, 0o600))
|
|
|
|
env := map[string]string{}
|
|
require.NoError(t, parseEnvFile(e, envPath, &env)(context.Background()))
|
|
assert.Equal(t, "bar", env["FOO"])
|
|
assert.Equal(t, "line1", env["MULTI"])
|
|
})
|
|
}
|
|
}
|
|
|
|
func TestParseEnvFileMissingDelimiter(t *testing.T) {
|
|
e, envPath := newTestHostEnv(t)
|
|
require.NoError(t, os.WriteFile(envPath, []byte("FOO<<EOF\nline1\nline2\n"), 0o600))
|
|
|
|
env := map[string]string{}
|
|
err := parseEnvFile(e, envPath, &env)(context.Background())
|
|
require.Error(t, err)
|
|
assert.Contains(t, err.Error(), "delimiter")
|
|
}
|