luckyimnotanigger/forgejo
1
0
Fork 0
mirror of https://codeberg.org/forgejo/forgejo.git synced 2025-05-27 04:07:08 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 4

chore(sec): unify usage of crypto/rand.Read (#7453)

Browse source 
- Unify the usage of [`crypto/rand.Read`](https://pkg.go.dev/crypto/rand#Read) to `util.CryptoRandomBytes`.
- Refactor `util.CryptoRandomBytes` to never return an error. It is documented by Go, https://go.dev/issue/66821, to always succeed. So if we still receive a error or if the returned bytes read is not equal to the expected bytes to be read we panic (just to be on the safe side).
- This simplifies a lot of code to no longer care about error handling.

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/7453
Reviewed-by: Earl Warren <earl-warren@noreply.codeberg.org>
Co-authored-by: Gusted <postmaster@gusted.xyz>
Co-committed-by: Gusted <postmaster@gusted.xyz>
This commit is contained in:
Gusted 2025-04-04 03:31:37 +00:00 • committed by Earl Warren
parent 99fc04b763
commit 53df0bf9a4
25 changed files with 61 additions and 163 deletions
Download patch file Download diff file Expand all files Collapse all files

4
tests/integration/api_packages_test.go
View file

@ -486,7 +486,7 @@ func TestPackageCleanup(t *testing.T) {
defer tests.PrintCurrentTest(t)()
// Upload and delete a generic package and upload a container blob
data, _ := util.CryptoRandomBytes(5)
data := util.CryptoRandomBytes(5)
url := fmt.Sprintf("/api/packages/%s/generic/cleanup-test/1.1.1/file.bin", user.Name)
req := NewRequestWithBody(t, "PUT", url, bytes.NewReader(data)).
AddBasicAuth(user.Name)
@ -496,7 +496,7 @@ func TestPackageCleanup(t *testing.T) {
AddBasicAuth(user.Name)
MakeRequest(t, req, http.StatusNoContent)
data, _ = util.CryptoRandomBytes(5)
data = util.CryptoRandomBytes(5)
url = fmt.Sprintf("/v2/%s/cleanup-test/blobs/uploads?digest=sha256:%x", user.Name, sha256.Sum256(data))
req = NewRequestWithBody(t, "POST", url, bytes.NewReader(data)).
AddBasicAuth(user.Name)