zeripath bbffcc3aec Multiple Escaping Improvements (#17551) ... There are multiple places where Gitea does not properly escape URLs that it is building and there are multiple places where it builds urls when there is already a simpler function available to use this. This is an extensive PR attempting to fix these issues. 1. The first commit in this PR looks through all href, src and links in the Gitea codebase and has attempted to catch all the places where there is potentially incomplete escaping. 2. Whilst doing this we will prefer to use functions that create URLs over recreating them by hand. 3. All uses of strings should be directly escaped - even if they are not currently expected to contain escaping characters. The main benefit to doing this will be that we can consider relaxing the constraints on user names and reponames in future. 4. The next commit looks at escaping in the wiki and re-considers the urls that are used there. Using the improved escaping here wiki files containing '/'. (This implementation will currently still place all of the wiki files the root directory of the repo but this would not be difficult to change.) 5. The title generation in feeds is now properly escaped. 6. EscapePound is no longer needed - urls should be PathEscaped / QueryEscaped as necessary but then re-escaped with Escape when creating html with locales Signed-off-by: Andrew Thornton <art27@cantab.net> Signed-off-by: Andrew Thornton <art27@cantab.net>		2021-11-16 18:18:25 +00:00
..
activitypub	Create pub/priv keypair for federation (#17071)	2021-09-28 15:19:22 -04:00
analyze	Use git attributes to determine generated and vendored status for language stats and diffs (#16773)	2021-09-09 21:13:36 +01:00
appstate	Decouple unit test code from business code (#17623)	2021-11-12 22:36:47 +08:00
auth	Add bundle download for repository (#14538)	2021-08-24 11:47:09 -05:00
avatar	refactor: move from io/ioutil to io and os package (#17109)	2021-09-22 13:38:34 +08:00
base	Fixed assert statements. (#16089)	2021-06-07 07:27:09 +02:00
cache	Add an abstract json layout to make it's easier to change json library (#16528)	2021-07-24 18:03:58 +02:00
charset	Read expected buffer size (#17409)	2021-10-24 22:12:43 +01:00
context	Multiple Escaping Improvements (#17551)	2021-11-16 18:18:25 +00:00
convert	Multiple Escaping Improvements (#17551)	2021-11-16 18:18:25 +00:00
csv	Properly determine CSV delimiter (#17459)	2021-10-30 23:50:40 +08:00
doctor	Move unit into models/unit/ (#17576)	2021-11-09 20:57:58 +01:00
emoji	Run processors on whole of text (#16155)	2021-06-17 11:35:05 +01:00
eventsource	Add an abstract json layout to make it's easier to change json library (#16528)	2021-07-24 18:03:58 +02:00
generate	switch to maintained lib (#16532)	2021-07-24 13:00:41 +02:00
git	Multiple Escaping Improvements (#17551)	2021-11-16 18:18:25 +00:00
gitgraph	Fix some lints (#17337)	2021-10-17 20:47:12 +01:00
graceful	Fix some lints (#17337)	2021-10-17 20:47:12 +01:00
hcaptcha	hCaptcha Support (#12594)	2020-10-02 23:37:53 -04:00
highlight	Prevent panic in Org mode HighlightCodeBlock (#17140)	2021-09-24 14:29:32 +01:00
hostmatcher	Only allow webhook to send requests to allowed hosts (#17482)	2021-11-01 16:39:52 +08:00
httpcache	Use a variable but a function for IsProd because of a slight performance increment (#17368)	2021-10-20 16:37:19 +02:00
httplib	refactor: move from io/ioutil to io and os package (#17109)	2021-09-22 13:38:34 +08:00
indexer	Fix nil checking on typed interface (#17598)	2021-11-15 21:16:11 +08:00
json	Add an abstract json layout to make it's easier to change json library (#16528)	2021-07-24 18:03:58 +02:00
lfs	Fix some lints (#17337)	2021-10-17 20:47:12 +01:00
log	refactor: move from io/ioutil to io and os package (#17109)	2021-09-22 13:38:34 +08:00
markup	Add copy button to markdown code blocks (#17638)	2021-11-16 16:16:05 +08:00
matchlist	Add Allow-/Block-List for Migrate & Mirrors (#13610)	2020-11-28 19:37:58 -05:00
metrics	Add metrics to get issues by repository (#17225)	2021-10-05 20:39:37 +02:00
migration	Move migrations into services and base into modules/migration (#17663)	2021-11-16 23:25:33 +08:00
nosql	Fix setting redis db path (#15698)	2021-05-03 13:24:24 -04:00
notification	Decouple unit test, remove intermediate unittestbridge package (#17662)	2021-11-16 16:53:21 +08:00
options	refactor: move from io/ioutil to io and os package (#17109)	2021-09-22 13:38:34 +08:00
password	Fixed assert statements. (#16089)	2021-06-07 07:27:09 +02:00
pprof	refactor: move from io/ioutil to io and os package (#17109)	2021-09-22 13:38:34 +08:00
private	refactor: move from io/ioutil to io and os package (#17109)	2021-09-22 13:38:34 +08:00
process	Code Formats, Nits & Unused Func/Var deletions (#15286)	2021-04-09 09:40:34 +02:00
proxy	Return nil proxy function if proxy not enabled (#16742)	2021-08-19 16:41:20 -04:00
public	refactor: move from io/ioutil to io and os package (#17109)	2021-09-22 13:38:34 +08:00
queue	Make the Mirror Queue a queue (#17326)	2021-10-17 12:43:25 +01:00
recaptcha	refactor: move from io/ioutil to io and os package (#17109)	2021-09-22 13:38:34 +08:00
references	Fix various documentation, user-facing, and source comment typos (#16367)	2021-07-08 13:38:13 +02:00
repofiles	Multiple Escaping Improvements (#17551)	2021-11-16 18:18:25 +00:00
repository	Multiple Escaping Improvements (#17551)	2021-11-16 18:18:25 +00:00
secret	Fix various documentation, user-facing, and source comment typos (#16367)	2021-07-08 13:38:13 +02:00
session	Move session to models/login (#17338)	2021-10-17 19:51:56 +01:00
setting	Use correct defaultValue for stracktrace (#17552)	2021-11-05 13:25:05 +02:00
ssh	Fix ipv6 parsing for builtin ssh server (#17561)	2021-11-06 14:23:32 +08:00
storage	refactor: move from io/ioutil to io and os package (#17109)	2021-09-22 13:38:34 +08:00
structs	Add migration from GitBucket (#16767)	2021-11-14 20:11:10 +01:00
svg	refactor: move from io/ioutil to io and os package (#17109)	2021-09-22 13:38:34 +08:00
sync	Fix missing unlock in uniquequeue (#9790)	2020-01-15 23:58:33 +02:00
task	Move migrations into services and base into modules/migration (#17663)	2021-11-16 23:25:33 +08:00
templates	Multiple Escaping Improvements (#17551)	2021-11-16 18:18:25 +00:00
test	Decouple unit test, remove intermediate unittestbridge package (#17662)	2021-11-16 16:53:21 +08:00
timeutil	Allow mocking timeutil (#17354)	2021-10-18 21:12:26 +01:00
translation	Use index of the supported tags to choose user lang (#15452)	2021-04-14 19:52:01 +01:00
typesniffer	Read expected buffer size (#17409)	2021-10-24 22:12:43 +01:00
updatechecker	Refactor update checker to use AppState (#17387)	2021-10-21 17:10:49 +01:00
upload	Multiple Escaping Improvements (#17551)	2021-11-16 18:18:25 +00:00
uri	Dump github/gitlab/gitea repository data to a local directory and restore to gitea (#12244)	2020-12-27 11:34:19 +08:00
user	Add gitea-vet (#10948)	2020-04-05 07:20:50 +01:00
util	Only allow webhook to send requests to allowed hosts (#17482)	2021-11-01 16:39:52 +08:00
validation	Upgrade chi to v5 (#17298)	2021-10-13 22:50:23 -04:00
web	Upgrade chi to v5 (#17298)	2021-10-13 22:50:23 -04:00