Merge remote-tracking branch 'giteaofficial/main'

* giteaofficial/main:
  Refactor render system (orgmode) (go-gitea#32671)
  Improve diff file tree (go-gitea#32658)
  Don't create action when syncing mirror pull refs (go-gitea#32659)
  Allow users with write permission to run actions (go-gitea#32644)
  Validate OAuth Redirect URIs (go-gitea#32643)

models/renderhelper/repo_file_test.go

@@ -12,6 +12,8 @@ import (
 	"code.gitea.io/gitea/modules/markup"
 	"code.gitea.io/gitea/modules/markup/markdown"
 
+	_ "code.gitea.io/gitea/modules/markup/orgmode"
+
 	"github.com/stretchr/testify/assert"
 )
 
@@ -81,3 +83,40 @@ func TestRepoFile(t *testing.T) {
 </video>`, rendered)
 	})
 }
+
+func TestRepoFileOrgMode(t *testing.T) {
+	unittest.PrepareTestEnv(t)
+	repo1 := unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: 1})
+
+	t.Run("Links", func(t *testing.T) {
+		rctx := NewRenderContextRepoFile(context.Background(), repo1, RepoFileOptions{
+			CurrentRefPath:  "/commit/1234",
+			CurrentTreePath: "my-dir",
+		}).WithRelativePath("my-dir/a.org")
+
+		rendered, err := markup.RenderString(rctx, `
+[[https://google.com/]]
+[[ImageLink.svg][The Image Desc]]
+`)
+		assert.NoError(t, err)
+		assert.Equal(t, `<p>
+<a href="https://google.com/" rel="nofollow">https://google.com/</a>
+<a href="/user2/repo1/media/commit/1234/my-dir/ImageLink.svg" rel="nofollow">The Image Desc</a></p>
+`, rendered)
+	})
+
+	t.Run("CodeHighlight", func(t *testing.T) {
+		rctx := NewRenderContextRepoFile(context.Background(), repo1, RepoFileOptions{}).WithRelativePath("my-dir/a.org")
+
+		rendered, err := markup.RenderString(rctx, `
+#+begin_src c
+int a = 1;
+#+end_src
+`)
+		assert.NoError(t, err)
+		assert.Equal(t, `<div>
+<pre><code class="chroma language-c"><span class="kt">int</span> <span class="n">a</span> <span class="o">=</span> <span class="mi">1</span><span class="p">;</span></code></pre>
+</div>
+`, rendered)
+	})
+}

modules/markup/orgmode/orgmode.go

@@ -6,10 +6,12 @@ package markup
 import (
 	"fmt"
 	"html"
+	"html/template"
 	"io"
 	"strings"
 
 	"code.gitea.io/gitea/modules/highlight"
+	"code.gitea.io/gitea/modules/htmlutil"
 	"code.gitea.io/gitea/modules/log"
 	"code.gitea.io/gitea/modules/markup"
 	"code.gitea.io/gitea/modules/setting"
@@ -20,33 +22,36 @@ import (
 )
 
 func init() {
-	markup.RegisterRenderer(Renderer{})
+	markup.RegisterRenderer(renderer{})
 }
 
 // Renderer implements markup.Renderer for orgmode
-type Renderer struct{}
+type renderer struct{}
 
-var _ markup.PostProcessRenderer = (*Renderer)(nil)
+var (
+	_ markup.Renderer            = (*renderer)(nil)
+	_ markup.PostProcessRenderer = (*renderer)(nil)
+)
 
 // Name implements markup.Renderer
-func (Renderer) Name() string {
+func (renderer) Name() string {
 	return "orgmode"
 }
 
 // NeedPostProcess implements markup.PostProcessRenderer
-func (Renderer) NeedPostProcess() bool { return true }
+func (renderer) NeedPostProcess() bool { return true }
 
 // Extensions implements markup.Renderer
-func (Renderer) Extensions() []string {
+func (renderer) Extensions() []string {
 	return []string{".org"}
 }
 
 // SanitizerRules implements markup.Renderer
-func (Renderer) SanitizerRules() []setting.MarkupSanitizerRule {
+func (renderer) SanitizerRules() []setting.MarkupSanitizerRule {
 	return []setting.MarkupSanitizerRule{}
 }
 
-// Render renders orgmode rawbytes to HTML
+// Render renders orgmode raw bytes to HTML
 func Render(ctx *markup.RenderContext, input io.Reader, output io.Writer) error {
 	htmlWriter := org.NewHTMLWriter()
 	htmlWriter.HighlightCodeBlock = func(source, lang string, inline bool, params map[string]string) string {
@@ -56,10 +61,7 @@ func Render(ctx *markup.RenderContext, input io.Reader, output io.Writer) error
 				panic(err)
 			}
 		}()
-		var w strings.Builder
-		if _, err := w.WriteString(`<pre>`); err != nil {
-			return ""
-		}
+		w := &strings.Builder{}
 
 		lexer := lexers.Get(lang)
 		if lexer == nil && lang == "" {
@@ -70,38 +72,28 @@ func Render(ctx *markup.RenderContext, input io.Reader, output io.Writer) error
 			lang = strings.ToLower(lexer.Config().Name)
 		}
 
+		// include language-x class as part of commonmark spec
+		if err := ctx.RenderInternal.FormatWithSafeAttrs(w, `<pre><code class="chroma language-%s">`, lang); err != nil {
+			return ""
+		}
 		if lexer == nil {
-			// include language-x class as part of commonmark spec
-			if _, err := w.WriteString(`<code class="chroma language-` + lang + `">`); err != nil {
-				return ""
-			}
 			if _, err := w.WriteString(html.EscapeString(source)); err != nil {
 				return ""
 			}
 		} else {
-			// include language-x class as part of commonmark spec
-			if _, err := w.WriteString(`<code class="chroma language-` + lang + `">`); err != nil {
-				return ""
-			}
 			lexer = chroma.Coalesce(lexer)
-
 			if _, err := w.WriteString(string(highlight.CodeFromLexer(lexer, source))); err != nil {
 				return ""
 			}
 		}
-
 		if _, err := w.WriteString("</code></pre>"); err != nil {
 			return ""
 		}
 
 		return w.String()
 	}
 
-	w := &Writer{
-		HTMLWriter: htmlWriter,
-		Ctx:        ctx,
-	}
-
+	w := &orgWriter{rctx: ctx, HTMLWriter: htmlWriter}
 	htmlWriter.ExtendingWriter = w
 
 	res, err := org.New().Silent().Parse(input, "").Write(w)
@@ -122,17 +114,18 @@ func RenderString(ctx *markup.RenderContext, content string) (string, error) {
 }
 
 // Render renders orgmode string to HTML string
-func (Renderer) Render(ctx *markup.RenderContext, input io.Reader, output io.Writer) error {
+func (renderer) Render(ctx *markup.RenderContext, input io.Reader, output io.Writer) error {
 	return Render(ctx, input, output)
 }
 
-// Writer implements org.Writer
-type Writer struct {
+type orgWriter struct {
 	*org.HTMLWriter
-	Ctx *markup.RenderContext
+	rctx *markup.RenderContext
 }
 
-func (r *Writer) resolveLink(kind, link string) string {
+var _ org.Writer = (*orgWriter)(nil)
+
+func (r *orgWriter) resolveLink(kind, link string) string {
 	link = strings.TrimPrefix(link, "file:")
 	if !strings.HasPrefix(link, "#") && // not a URL fragment
 		!markup.IsFullURLString(link) {
@@ -142,39 +135,42 @@ func (r *Writer) resolveLink(kind, link string) string {
 			kind = org.RegularLink{URL: link}.Kind()
 		}
 		if kind == "image" || kind == "video" {
-			link = r.Ctx.RenderHelper.ResolveLink(link, markup.LinkTypeMedia)
+			link = r.rctx.RenderHelper.ResolveLink(link, markup.LinkTypeMedia)
 		} else {
-			link = r.Ctx.RenderHelper.ResolveLink(link, markup.LinkTypeDefault)
+			link = r.rctx.RenderHelper.ResolveLink(link, markup.LinkTypeDefault)
 		}
 	}
 	return link
 }
 
 // WriteRegularLink renders images, links or videos
-func (r *Writer) WriteRegularLink(l org.RegularLink) {
+func (r *orgWriter) WriteRegularLink(l org.RegularLink) {
 	link := r.resolveLink(l.Kind(), l.URL)
 
+	printHTML := func(html string, a ...any) {
+		_, _ = fmt.Fprint(r, htmlutil.HTMLFormat(html, a...))
+	}
 	// Inspired by https://github.com/niklasfasching/go-org/blob/6eb20dbda93cb88c3503f7508dc78cbbc639378f/org/html_writer.go#L406-L427
 	switch l.Kind() {
 	case "image":
 		if l.Description == nil {
-			_, _ = fmt.Fprintf(r, `<img src="%s" alt="%s" />`, link, link)
+			printHTML(`<img src="%s" alt="%s">`, link, link)
 		} else {
 			imageSrc := r.resolveLink(l.Kind(), org.String(l.Description...))
-			_, _ = fmt.Fprintf(r, `<a href="%s"><img src="%s" alt="%s" /></a>`, link, imageSrc, imageSrc)
+			printHTML(`<a href="%s"><img src="%s" alt="%s"></a>`, link, imageSrc, imageSrc)
 		}
 	case "video":
 		if l.Description == nil {
-			_, _ = fmt.Fprintf(r, `<video src="%s">%s</video>`, link, link)
+			printHTML(`<video src="%s">%s</video>`, link, link)
 		} else {
 			videoSrc := r.resolveLink(l.Kind(), org.String(l.Description...))
-			_, _ = fmt.Fprintf(r, `<a href="%s"><video src="%s">%s</video></a>`, link, videoSrc, videoSrc)
+			printHTML(`<a href="%s"><video src="%s">%s</video></a>`, link, videoSrc, videoSrc)
 		}
 	default:
-		description := link
+		var description any = link
 		if l.Description != nil {
-			description = r.WriteNodesAsString(l.Description...)
+			description = template.HTML(r.WriteNodesAsString(l.Description...)) // orgmode HTMLWriter outputs HTML content
 		}
-		_, _ = fmt.Fprintf(r, `<a href="%s">%s</a>`, link, description)
+		printHTML(`<a href="%s">%s</a>`, link, description)
 	}
 }

modules/markup/orgmode/orgmode_test.go

@@ -58,35 +58,35 @@ func TestRender_Media(t *testing.T) {
 	}
 
 	test("[[file:../../.images/src/02/train.jpg]]",
-		`<p><img src=".images/src/02/train.jpg" alt=".images/src/02/train.jpg" /></p>`)
+		`<p><img src=".images/src/02/train.jpg" alt=".images/src/02/train.jpg"></p>`)
 	test("[[file:train.jpg]]",
-		`<p><img src="relative-path/train.jpg" alt="relative-path/train.jpg" /></p>`)
+		`<p><img src="relative-path/train.jpg" alt="relative-path/train.jpg"></p>`)
 
 	// With description.
 	test("[[https://example.com][https://example.com/example.svg]]",
-		`<p><a href="https://example.com"><img src="https://example.com/example.svg" alt="https://example.com/example.svg" /></a></p>`)
+		`<p><a href="https://example.com"><img src="https://example.com/example.svg" alt="https://example.com/example.svg"></a></p>`)
 	test("[[https://example.com][pre https://example.com/example.svg post]]",
-		`<p><a href="https://example.com">pre <img src="https://example.com/example.svg" alt="https://example.com/example.svg" /> post</a></p>`)
+		`<p><a href="https://example.com">pre <img src="https://example.com/example.svg" alt="https://example.com/example.svg"> post</a></p>`)
 	test("[[https://example.com][https://example.com/example.mp4]]",
 		`<p><a href="https://example.com"><video src="https://example.com/example.mp4">https://example.com/example.mp4</video></a></p>`)
 	test("[[https://example.com][pre https://example.com/example.mp4 post]]",
 		`<p><a href="https://example.com">pre <video src="https://example.com/example.mp4">https://example.com/example.mp4</video> post</a></p>`)
 
 	// Without description.
 	test("[[https://example.com/example.svg]]",
-		`<p><img src="https://example.com/example.svg" alt="https://example.com/example.svg" /></p>`)
+		`<p><img src="https://example.com/example.svg" alt="https://example.com/example.svg"></p>`)
 	test("[[https://example.com/example.mp4]]",
 		`<p><video src="https://example.com/example.mp4">https://example.com/example.mp4</video></p>`)
 
 	// test [[LINK][DESCRIPTION]] syntax with "file:" prefix
 	test(`[[https://example.com/][file:https://example.com/foo%20bar.svg]]`,
-		`<p><a href="https://example.com/"><img src="https://example.com/foo%20bar.svg" alt="https://example.com/foo%20bar.svg" /></a></p>`)
+		`<p><a href="https://example.com/"><img src="https://example.com/foo%20bar.svg" alt="https://example.com/foo%20bar.svg"></a></p>`)
 	test(`[[file:https://example.com/foo%20bar.svg][Goto Image]]`,
 		`<p><a href="https://example.com/foo%20bar.svg">Goto Image</a></p>`)
 	test(`[[file:https://example.com/link][https://example.com/image.jpg]]`,
-		`<p><a href="https://example.com/link"><img src="https://example.com/image.jpg" alt="https://example.com/image.jpg" /></a></p>`)
+		`<p><a href="https://example.com/link"><img src="https://example.com/image.jpg" alt="https://example.com/image.jpg"></a></p>`)
 	test(`[[file:https://example.com/link][file:https://example.com/image.jpg]]`,
-		`<p><a href="https://example.com/link"><img src="https://example.com/image.jpg" alt="https://example.com/image.jpg" /></a></p>`)
+		`<p><a href="https://example.com/link"><img src="https://example.com/image.jpg" alt="https://example.com/image.jpg"></a></p>`)
 }
 
 func TestRender_Source(t *testing.T) {

modules/util/truncate.go

@@ -41,6 +41,8 @@ func SplitStringAtByteN(input string, n int) (left, right string) {
 
 // SplitTrimSpace splits the string at given separator and trims leading and trailing space
 func SplitTrimSpace(input, sep string) []string {
+	// Trim initial leading & trailing space
+	input = strings.TrimSpace(input)
 	// replace CRLF with LF
 	input = strings.ReplaceAll(input, "\r\n", "\n")
 

modules/validation/binding.go

@@ -10,6 +10,7 @@ import (
 
 	"code.gitea.io/gitea/modules/auth"
 	"code.gitea.io/gitea/modules/git"
+	"code.gitea.io/gitea/modules/util"
 
 	"gitea.com/go-chi/binding"
 	"github.com/gobwas/glob"
@@ -31,6 +32,7 @@ const (
 // AddBindingRules adds additional binding rules
 func AddBindingRules() {
 	addGitRefNameBindingRule()
+	addValidURLListBindingRule()
 	addValidURLBindingRule()
 	addValidSiteURLBindingRule()
 	addGlobPatternRule()
@@ -44,7 +46,7 @@ func addGitRefNameBindingRule() {
 	// Git refname validation rule
 	binding.AddRule(&binding.Rule{
 		IsMatch: func(rule string) bool {
-			return strings.HasPrefix(rule, "GitRefName")
+			return rule == "GitRefName"
 		},
 		IsValid: func(errs binding.Errors, name string, val any) (bool, binding.Errors) {
 			str := fmt.Sprintf("%v", val)
@@ -58,11 +60,38 @@ func addGitRefNameBindingRule() {
 	})
 }
 
+func addValidURLListBindingRule() {
+	// URL validation rule
+	binding.AddRule(&binding.Rule{
+		IsMatch: func(rule string) bool {
+			return rule == "ValidUrlList"
+		},
+		IsValid: func(errs binding.Errors, name string, val any) (bool, binding.Errors) {
+			str := fmt.Sprintf("%v", val)
+			if len(str) == 0 {
+				errs.Add([]string{name}, binding.ERR_URL, "Url")
+				return false, errs
+			}
+
+			ok := true
+			urls := util.SplitTrimSpace(str, "\n")
+			for _, u := range urls {
+				if !IsValidURL(u) {
+					ok = false
+					errs.Add([]string{name}, binding.ERR_URL, u)
+				}
+			}
+
+			return ok, errs
+		},
+	})
+}
+
 func addValidURLBindingRule() {
 	// URL validation rule
 	binding.AddRule(&binding.Rule{
 		IsMatch: func(rule string) bool {
-			return strings.HasPrefix(rule, "ValidUrl")
+			return rule == "ValidUrl"
 		},
 		IsValid: func(errs binding.Errors, name string, val any) (bool, binding.Errors) {
 			str := fmt.Sprintf("%v", val)
@@ -80,7 +109,7 @@ func addValidSiteURLBindingRule() {
 	// URL validation rule
 	binding.AddRule(&binding.Rule{
 		IsMatch: func(rule string) bool {
-			return strings.HasPrefix(rule, "ValidSiteUrl")
+			return rule == "ValidSiteUrl"
 		},
 		IsValid: func(errs binding.Errors, name string, val any) (bool, binding.Errors) {
 			str := fmt.Sprintf("%v", val)
@@ -171,7 +200,7 @@ func addUsernamePatternRule() {
 func addValidGroupTeamMapRule() {
 	binding.AddRule(&binding.Rule{
 		IsMatch: func(rule string) bool {
-			return strings.HasPrefix(rule, "ValidGroupTeamMap")
+			return rule == "ValidGroupTeamMap"
 		},
 		IsValid: func(errs binding.Errors, name string, val any) (bool, binding.Errors) {
 			_, err := auth.UnmarshalGroupTeamMapping(fmt.Sprintf("%v", val))

modules/validation/binding_test.go

@@ -27,6 +27,7 @@ type (
 	TestForm struct {
 		BranchName   string `form:"BranchName" binding:"GitRefName"`
 		URL          string `form:"ValidUrl" binding:"ValidUrl"`
+		URLs         string `form:"ValidUrls" binding:"ValidUrlList"`
 		GlobPattern  string `form:"GlobPattern" binding:"GlobPattern"`
 		RegexPattern string `form:"RegexPattern" binding:"RegexPattern"`
 	}