diff --git a/routers/api/v1/activitypub/repository.go b/routers/api/v1/activitypub/repository.go index 0f0b1ef6f3..ae43406a89 100644 --- a/routers/api/v1/activitypub/repository.go +++ b/routers/api/v1/activitypub/repository.go @@ -23,6 +23,7 @@ import ( "code.gitea.io/gitea/modules/setting" "code.gitea.io/gitea/modules/util" "code.gitea.io/gitea/modules/web" + "code.gitea.io/routers/utils" "github.com/google/uuid" ap "github.com/go-ap/activitypub" @@ -206,7 +207,7 @@ func createUserFromAP(ctx *context.APIContext, personId forgefed.PersonId) (*use if err != nil { return &user_model.User{}, err } - log.Info("RepositoryInbox: got body: %v", char_limiter(string(body), 120)) + log.Info("RepositoryInbox: got body: %v", utils.CharLimiter(string(body), 120)) person := ap.Person{} err = person.UnmarshalJSON(body) @@ -249,19 +250,3 @@ func createUserFromAP(ctx *context.APIContext, personId forgefed.PersonId) (*use return user, nil } - -// Thanks to https://www.socketloop.com/tutorials/golang-characters-limiter-example -func char_limiter(s string, limit int) string { - - reader := strings.NewReader(s) - - buff := make([]byte, limit) - - n, _ := io.ReadAtLeast(reader, buff, limit) - - if n != 0 { - return fmt.Sprint(string(buff), "...") - } else { - return s - } -} diff --git a/routers/utils/utils.go b/routers/utils/utils.go index 1f4d11fd3c..56f7aa2215 100644 --- a/routers/utils/utils.go +++ b/routers/utils/utils.go @@ -4,7 +4,9 @@ package utils import ( + "fmt" "html" + "io" "net/url" "strings" @@ -28,3 +30,20 @@ func IsExternalURL(rawURL string) bool { } return false } + +// Limit number of characters in a string (useful to prevent log injection attacks and overly long log outputs) +// Thanks to https://www.socketloop.com/tutorials/golang-characters-limiter-example +func CharLimiter(s string, limit int) string { + + reader := strings.NewReader(s) + + buff := make([]byte, limit) + + n, _ := io.ReadAtLeast(reader, buff, limit) + + if n != 0 { + return fmt.Sprint(string(buff), "...") + } else { + return s + } +}