forgejo/modules/git/pushoptions/pushoptions.go
Mathieu Fenniak f93d2cb261 ci: detect and prevent empty case statements in Go code (#11593)
One of the security patches released 2026-03-09 [fixed a vulnerability](d1c7b04d09) caused by a misapplication of Go `case` statements, where the implementation would have been correct if Go `case` statements automatically fall through to the next case block, but they do not.  This PR adds a semgrep rule which detects any empty `case` statement and raises an error, in order to prevent this coding mistake in the future.

For example, code like this will now trigger a build error:
```go
	switch setting.Protocol {
	case setting.HTTPUnix:
	case setting.FCGI:
	case setting.FCGIUnix:
	default:
		defaultLocalURL := string(setting.Protocol) + "://"
	}
```

Example error:
```
    cmd/web.go
   ❯❯❱ semgrep.config.forgejo-switch-empty-case
          switch has a case block with no content. This is treated as "break" by Go, but developers may
          confuse it for "fallthrough".  To fix this error, disambiguate by using "break" or
          "fallthrough".

          279┆ switch setting.Protocol {
          280┆ case setting.HTTPUnix:
          281┆ case setting.FCGI:
          282┆ case setting.FCGIUnix:
          283┆ default:
          284┆   defaultLocalURL := string(setting.Protocol) + "://"
          285┆   if setting.HTTPAddr == "0.0.0.0" {
          286┆           defaultLocalURL += "localhost"
          287┆   } else {
          288┆           defaultLocalURL += setting.HTTPAddr
```

As described in the error output, this error can be fixed by explicitly listing `break` (the real Go behaviour, to do nothing in the block), or by listing `fallthrough` (if the intent was to fall through).

All existing code triggering this detection has been changed to `break` (or, rarely, irrelevant cases have been removed), which should maintain the same code functionality.  While performing this fixup, a light analysis was performed on each case and they *appeared* correct, but with ~65 cases I haven't gone into extreme depth.

Tests are present for the semgrep rule in `.semgrep/tests/go.go`.

## Checklist

The [contributor guide](https://forgejo.org/docs/next/contributor/) contains information that will be helpful to first time contributors. There also are a few [conditions for merging Pull Requests in Forgejo repositories](https://codeberg.org/forgejo/governance/src/branch/main/PullRequestsAgreement.md). You are also welcome to join the [Forgejo development chatroom](https://matrix.to/#/#forgejo-development:matrix.org).

### Documentation

- [ ] I created a pull request [to the documentation](https://codeberg.org/forgejo/docs) to explain to Forgejo users how to use this change.
- [x] I did not document these changes and I do not expect someone else to do it.

### Release notes

- [ ] This change will be noticed by a Forgejo user or admin (feature, bug fix, performance, etc.). I suggest to include a release note for this change.
- [x] This change is not visible to a Forgejo user or admin (refactor, dependency upgrade, etc.). I think there is no need to add a release note for this change.

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/11593
Reviewed-by: Gusted <gusted@noreply.codeberg.org>
Co-authored-by: Mathieu Fenniak <mathieu@fenniak.net>
Co-committed-by: Mathieu Fenniak <mathieu@fenniak.net>
2026-03-10 02:50:28 +01:00

127 lines
2.5 KiB
Go

// Copyright twenty-panda <twenty-panda@posteo.com>
// SPDX-License-Identifier: MIT
package pushoptions
import (
"encoding/base64"
"fmt"
"os"
"strconv"
"strings"
)
type Key string
const (
RepoPrivate = Key("repo.private")
RepoTemplate = Key("repo.template")
AgitTopic = Key("topic")
AgitForcePush = Key("force-push")
AgitTitle = Key("title")
AgitDescription = Key("description")
envPrefix = "GIT_PUSH_OPTION"
EnvCount = envPrefix + "_COUNT"
EnvFormat = envPrefix + "_%d"
)
type Interface interface {
ReadEnv() Interface
Parse(string) bool
Map() map[string]string
ChangeRepoSettings() bool
Empty() bool
GetBool(key Key, def bool) bool
GetString(key Key) (val string, ok bool)
}
type gitPushOptions map[string]string
func New() Interface {
pushOptions := gitPushOptions(make(map[string]string))
return &pushOptions
}
func NewFromMap(o *map[string]string) Interface {
return (*gitPushOptions)(o)
}
func (o *gitPushOptions) ReadEnv() Interface {
if pushCount, err := strconv.Atoi(os.Getenv(EnvCount)); err == nil {
for idx := 0; idx < pushCount; idx++ {
_ = o.Parse(os.Getenv(fmt.Sprintf(EnvFormat, idx)))
}
}
return o
}
func (o *gitPushOptions) Parse(data string) bool {
key, value, found := strings.Cut(data, "=")
if !found {
value = "true"
}
switch Key(key) {
case RepoPrivate, RepoTemplate, AgitTopic, AgitForcePush, AgitTitle, AgitDescription:
break
default:
return false
}
(*o)[key] = value
return true
}
func (o gitPushOptions) Map() map[string]string {
return o
}
func (o gitPushOptions) ChangeRepoSettings() bool {
if o.Empty() {
return false
}
for _, key := range []Key{RepoPrivate, RepoTemplate} {
_, ok := o[string(key)]
if ok {
return true
}
}
return false
}
func (o gitPushOptions) Empty() bool {
return len(o) == 0
}
func (o gitPushOptions) GetBool(key Key, def bool) bool {
if val, ok := o[string(key)]; ok {
if b, err := strconv.ParseBool(val); err == nil {
return b
}
}
return def
}
func (o gitPushOptions) GetString(key Key) (string, bool) {
val, ok := o[string(key)]
if !ok {
return "", false
}
// If the value is prefixed with `{base64}` then everything after that is very
// likely to be encoded via base64.
base64Value, found := strings.CutPrefix(val, "{base64}")
if !found {
return val, true
}
value, err := base64.StdEncoding.DecodeString(base64Value)
if err != nil {
// Not valid base64? Return the original value.
return val, true
}
return string(value), true
}