mirror of
https://codeberg.org/forgejo/forgejo.git
synced 2026-04-19 04:50:33 +00:00
One of the security patches released 2026-03-09 [fixed a vulnerability](https://codeberg.org/forgejo/forgejo/pulls/11513/commits/d1c7b04d09f6a13896eaa1322ac690b2021539da) caused by a misapplication of Go `case` statements, where the implementation would have been correct if Go `case` statements automatically fall through to the next case block, but they do not. This PR adds a semgrep rule which detects any empty `case` statement and raises an error, in order to prevent this coding mistake in the future. For example, code like this will now trigger a build error: ```go switch setting.Protocol { case setting.HTTPUnix: case setting.FCGI: case setting.FCGIUnix: default: defaultLocalURL := string(setting.Protocol) + "://" } ``` Example error: ``` cmd/web.go ❯❯❱ semgrep.config.forgejo-switch-empty-case switch has a case block with no content. This is treated as "break" by Go, but developers may confuse it for "fallthrough". To fix this error, disambiguate by using "break" or "fallthrough". 279┆ switch setting.Protocol { 280┆ case setting.HTTPUnix: 281┆ case setting.FCGI: 282┆ case setting.FCGIUnix: 283┆ default: 284┆ defaultLocalURL := string(setting.Protocol) + "://" 285┆ if setting.HTTPAddr == "0.0.0.0" { 286┆ defaultLocalURL += "localhost" 287┆ } else { 288┆ defaultLocalURL += setting.HTTPAddr ``` As described in the error output, this error can be fixed by explicitly listing `break` (the real Go behaviour, to do nothing in the block), or by listing `fallthrough` (if the intent was to fall through). All existing code triggering this detection has been changed to `break` (or, rarely, irrelevant cases have been removed), which should maintain the same code functionality. While performing this fixup, a light analysis was performed on each case and they *appeared* correct, but with ~65 cases I haven't gone into extreme depth. Tests are present for the semgrep rule in `.semgrep/tests/go.go`. ## Checklist The [contributor guide](https://forgejo.org/docs/next/contributor/) contains information that will be helpful to first time contributors. There also are a few [conditions for merging Pull Requests in Forgejo repositories](https://codeberg.org/forgejo/governance/src/branch/main/PullRequestsAgreement.md). You are also welcome to join the [Forgejo development chatroom](https://matrix.to/#/#forgejo-development:matrix.org). ### Documentation - [ ] I created a pull request [to the documentation](https://codeberg.org/forgejo/docs) to explain to Forgejo users how to use this change. - [x] I did not document these changes and I do not expect someone else to do it. ### Release notes - [ ] This change will be noticed by a Forgejo user or admin (feature, bug fix, performance, etc.). I suggest to include a release note for this change. - [x] This change is not visible to a Forgejo user or admin (refactor, dependency upgrade, etc.). I think there is no need to add a release note for this change. Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/11593 Reviewed-by: Gusted <gusted@noreply.codeberg.org> Co-authored-by: Mathieu Fenniak <mathieu@fenniak.net> Co-committed-by: Mathieu Fenniak <mathieu@fenniak.net>
86 lines
2.2 KiB
Go
86 lines
2.2 KiB
Go
// Copyright 2019 The Gitea Authors. All rights reserved.
|
|
// SPDX-License-Identifier: MIT
|
|
|
|
package setting
|
|
|
|
import (
|
|
"strings"
|
|
"time"
|
|
|
|
"forgejo.org/modules/log"
|
|
)
|
|
|
|
// Cache represents cache settings
|
|
type Cache struct {
|
|
Adapter string
|
|
Interval int
|
|
Conn string
|
|
TTL time.Duration `ini:"ITEM_TTL"`
|
|
}
|
|
|
|
// CacheService the global cache
|
|
var CacheService = struct {
|
|
Cache `ini:"cache"`
|
|
|
|
LastCommit struct {
|
|
TTL time.Duration `ini:"ITEM_TTL"`
|
|
CommitsCount int64
|
|
} `ini:"cache.last_commit"`
|
|
}{
|
|
Cache: Cache{
|
|
Adapter: "memory",
|
|
Interval: 60,
|
|
TTL: 16 * time.Hour,
|
|
},
|
|
LastCommit: struct {
|
|
TTL time.Duration `ini:"ITEM_TTL"`
|
|
CommitsCount int64
|
|
}{
|
|
TTL: 8760 * time.Hour,
|
|
CommitsCount: 1000,
|
|
},
|
|
}
|
|
|
|
// MemcacheMaxTTL represents the maximum memcache TTL
|
|
const MemcacheMaxTTL = 30 * 24 * time.Hour
|
|
|
|
func loadCacheFrom(rootCfg ConfigProvider) {
|
|
sec := rootCfg.Section("cache")
|
|
if err := sec.MapTo(&CacheService); err != nil {
|
|
log.Fatal("Failed to map Cache settings: %v", err)
|
|
}
|
|
|
|
CacheService.Adapter = sec.Key("ADAPTER").In("memory", []string{"memory", "redis", "memcache", "twoqueue"})
|
|
switch CacheService.Adapter {
|
|
case "memory":
|
|
break
|
|
case "redis", "memcache":
|
|
CacheService.Conn = strings.Trim(sec.Key("HOST").String(), "\" ")
|
|
case "twoqueue":
|
|
CacheService.Conn = strings.TrimSpace(sec.Key("HOST").String())
|
|
if CacheService.Conn == "" {
|
|
CacheService.Conn = "50000"
|
|
}
|
|
default:
|
|
log.Fatal("Unknown cache adapter: %s", CacheService.Adapter)
|
|
}
|
|
|
|
sec = rootCfg.Section("cache.last_commit")
|
|
CacheService.LastCommit.CommitsCount = sec.Key("COMMITS_COUNT").MustInt64(1000)
|
|
}
|
|
|
|
// TTLSeconds returns the TTLSeconds or unix timestamp for memcache
|
|
func (c Cache) TTLSeconds() int64 {
|
|
if c.Adapter == "memcache" && c.TTL > MemcacheMaxTTL {
|
|
return time.Now().Add(c.TTL).Unix()
|
|
}
|
|
return int64(c.TTL.Seconds())
|
|
}
|
|
|
|
// LastCommitCacheTTLSeconds returns the TTLSeconds or unix timestamp for memcache
|
|
func LastCommitCacheTTLSeconds() int64 {
|
|
if CacheService.Adapter == "memcache" && CacheService.LastCommit.TTL > MemcacheMaxTTL {
|
|
return time.Now().Add(CacheService.LastCommit.TTL).Unix()
|
|
}
|
|
return int64(CacheService.LastCommit.TTL.Seconds())
|
|
}
|