repo/editor: clean up tree path

Fixes a security issue reported by @zeripath.

2 files changed, 64 insertions, 0 deletions

diff --git a/internal/pathutil/pathutil.go b/internal/pathutil/pathutil.go
new file mode 100644
index 00000000..6a7286e1
--- /dev/null
+++ b/internal/pathutil/pathutil.go
@@ -0,0 +1,15 @@
+// Copyright 2020 The Gogs Authors. All rights reserved.
+// Use of this source code is governed by a MIT-style
+// license that can be found in the LICENSE file.
+
+package pathutil
+
+import (
+	"path"
+	"strings"
+)
+
+// Clean cleans up given path and returns a relative path that goes straight down.
+func Clean(p string) string {
+	return strings.Trim(path.Clean("/"+p), "/")
+}
diff --git a/internal/pathutil/pathutil_test.go b/internal/pathutil/pathutil_test.go
new file mode 100644
index 00000000..eb8cc176
--- /dev/null
+++ b/internal/pathutil/pathutil_test.go
@@ -0,0 +1,49 @@
+// Copyright 2020 The Gogs Authors. All rights reserved.
+// Use of this source code is governed by a MIT-style
+// license that can be found in the LICENSE file.
+
+package pathutil
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestClean(t *testing.T) {
+	tests := []struct {
+		path   string
+		expVal string
+	}{
+		{
+			path:   "../../../readme.txt",
+			expVal: "readme.txt",
+		},
+		{
+			path:   "a/../../../readme.txt",
+			expVal: "readme.txt",
+		},
+		{
+			path:   "/../a/b/../c/../readme.txt",
+			expVal: "a/readme.txt",
+		},
+		{
+			path:   "/a/readme.txt",
+			expVal: "a/readme.txt",
+		},
+		{
+			path:   "/",
+			expVal: "",
+		},
+
+		{
+			path:   "/a/b/c/readme.txt",
+			expVal: "a/b/c/readme.txt",
+		},
+	}
+	for _, test := range tests {
+		t.Run("", func(t *testing.T) {
+			assert.Equal(t, test.expVal, Clean(test.path))
+		})
+	}
+}