Skip to content

Commit 1b442ee

Browse files
antonioaversaantonioaversa
authored
SQSCANGHA-55 Add curl redirect and fix splatting of URL with special chars
1 parent f4eddd9 commit 1b442ee

File tree

5 files changed

+137
-26
lines changed

5 files changed

+137
-26
lines changed

‎.github/qa-nginx-redirecting/compose.yml

+13
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
services:
2+
https-proxy:
3+
image: nginx
4+
ports:
5+
- 8080:8080
6+
volumes:
7+
- $GITHUB_WORKSPACE/.github/qa-nginx-redirecting/nginx.conf:/etc/nginx/nginx.conf:ro
8+
healthcheck:
9+
test: ["CMD", "curl", "--fail", "localhost:8080/health"]
10+
interval: 10s
11+
timeout: 5s
12+
retries: 20
13+
start_period: 2m

‎.github/qa-nginx-redirecting/nginx.conf

+32
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
user nginx;
2+
worker_processes auto;
3+
4+
error_log /var/log/nginx/error.log notice;
5+
6+
events {
7+
worker_connections 1024;
8+
}
9+
10+
http {
11+
include /etc/nginx/mime.types;
12+
default_type application/octet-stream;
13+
14+
sendfile on;
15+
16+
keepalive_timeout 65;
17+
18+
include /etc/nginx/conf.d/*.conf;
19+
20+
server {
21+
listen 8080;
22+
23+
location /health {
24+
add_header 'Content-Type' 'text/plain';
25+
return 200 "healthy\n";
26+
}
27+
28+
location ~ /clientRedirectToSonarBinaries/(.*) {
29+
return 301 "https://binaries.sonarsource.com/Distribution/sonar-scanner-cli/$1";
30+
}
31+
}
32+
}

‎.github/qa-sq-behind-ngix/nginx.conf

-11
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,6 @@ user nginx;
22
worker_processes auto;
33

44
error_log /var/log/nginx/error.log notice;
5-
pid /var/run/nginx.pid;
65

76
events {
87
worker_connections 1024;
@@ -12,12 +11,6 @@ http {
1211
include /etc/nginx/mime.types;
1312
default_type application/octet-stream;
1413

15-
log_format main '$remote_addr - $remote_user [$time_local] "$request" '
16-
'$status $body_bytes_sent "$http_referer" '
17-
'"$http_user_agent" "$http_x_forwarded_for"';
18-
19-
access_log /var/log/nginx/access.log main;
20-
2114
sendfile on;
2215

2316
keepalive_timeout 65;
@@ -28,7 +21,6 @@ http {
2821
listen 8080;
2922

3023
location /health {
31-
access_log off;
3224
add_header 'Content-Type' 'text/plain';
3325
return 200 "healthy\n";
3426
}
@@ -40,9 +32,6 @@ http {
4032
ssl_protocols TLSv1.1 TLSv1.2;
4133
ssl_certificate /etc/nginx/server.crt;
4234
ssl_certificate_key /etc/nginx/server.key;
43-
44-
access_log /var/log/nginx/localhost;
45-
error_log /var/log/nginx/localhost.error debug;
4635

4736
location / {
4837
proxy_pass http://sonarqube:9000;

‎.github/workflows/qa.yml

+81
Original file line numberDiff line numberDiff line change
@@ -116,6 +116,56 @@ jobs:
116116
- name: Assert Sonar Scanner CLI was not executed
117117
run: |
118118
./test/assertFileDoesntExist ./output.properties
119+
scannerBinariesUrlIsEscapedWithWget:
120+
name: >
121+
'scannerBinariesUrl' is escaped with wget so special chars are not injected in the download command
122+
runs-on: ubuntu-latest
123+
steps:
124+
- uses: actions/checkout@v4
125+
with:
126+
token: ${{ secrets.GITHUB_TOKEN }}
127+
- name: Run action with scannerBinariesUrl
128+
id: runTest
129+
uses: ./
130+
continue-on-error: true
131+
with:
132+
scannerBinariesUrl: 'http://some_uri;touch file.txt;'
133+
env:
134+
NO_CACHE: true
135+
SONAR_HOST_URL: http://not_actually_used
136+
SONAR_SCANNER_JSON_PARAMS: '{"sonar.scanner.internal.dumpToFile": "./output1.properties"}'
137+
- name: Assert file.txt does not exist
138+
run: |
139+
./test/assertFileDoesntExist "$RUNNER_TEMP/sonarscanner/file.txt"
140+
scannerBinariesUrlIsEscapedWithCurl:
141+
name: >
142+
'scannerBinariesUrl' is escaped with curl so special chars are not injected in the download command
143+
runs-on: ubuntu-latest
144+
steps:
145+
- uses: actions/checkout@v4
146+
with:
147+
token: ${{ secrets.GITHUB_TOKEN }}
148+
- name: Remove wget
149+
run: sudo apt-get remove -y wget
150+
- name: Assert wget is not available
151+
run: |
152+
if command -v wget 2>&1 >/dev/null
153+
then
154+
exit 1
155+
fi
156+
- name: Run action with scannerBinariesUrl
157+
id: runTest
158+
uses: ./
159+
continue-on-error: true
160+
with:
161+
scannerBinariesUrl: 'http://some_uri http://another_uri''; touch file.txt;'
162+
env:
163+
NO_CACHE: true
164+
SONAR_HOST_URL: http://not_actually_used
165+
SONAR_SCANNER_JSON_PARAMS: '{"sonar.scanner.internal.dumpToFile": "./output1.properties"}'
166+
- name: Assert file.txt does not exist
167+
run: |
168+
./test/assertFileDoesntExist "$RUNNER_TEMP/sonarscanner/file.txt"
119169
dontFailGradleTest:
120170
name: >
121171
Don't fail on Gradle project
@@ -376,6 +426,37 @@ jobs:
376426
- name: Assert failure of previous step
377427
if: steps.runTest.outcome == 'success'
378428
run: exit 1
429+
curlPerformsRedirect:
430+
name: >
431+
curl performs redirect when scannerBinariesUrl returns 3xx
432+
runs-on: ubuntu-latest
433+
steps:
434+
- uses: actions/checkout@v4
435+
with:
436+
token: ${{ secrets.GITHUB_TOKEN }}
437+
- name: Remove wget
438+
run: sudo apt-get remove -y wget
439+
- name: Assert wget is not available
440+
run: |
441+
if command -v wget 2>&1 >/dev/null
442+
then
443+
exit 1
444+
fi
445+
- name: Start nginx via Docker Compose
446+
run: docker compose up -d --wait
447+
working-directory: .github/qa-nginx-redirecting
448+
- name: Run action with scannerBinariesUrl
449+
id: runTest
450+
uses: ./
451+
with:
452+
scannerBinariesUrl: http://localhost:8080/clientRedirectToSonarBinaries
453+
env:
454+
NO_CACHE: true
455+
SONAR_HOST_URL: http://not_actually_used
456+
SONAR_SCANNER_JSON_PARAMS: '{"sonar.scanner.internal.dumpToFile": "./output1.properties"}'
457+
- name: Assert Sonar Scanner CLI was downloaded
458+
run: |
459+
./test/assertFileExists "$RUNNER_TEMP/sonarscanner/sonar-scanner-cli-6.2.1.4610-linux-x64.zip"
379460
useSslCertificate:
380461
name: >
381462
'SONAR_ROOT_CERT' is converted to truststore

‎install-sonar-scanner-cli.sh

+11-15
Original file line numberDiff line numberDiff line change
@@ -23,33 +23,29 @@ else
2323
exit 1
2424
fi
2525

26+
set -x
27+
28+
mkdir -p $RUNNER_TEMP/sonarscanner
29+
cd $RUNNER_TEMP/sonarscanner
30+
2631
SCANNER_FILE_NAME="sonar-scanner-cli-$INPUT_SCANNERVERSION-$FLAVOR.zip"
2732
SCANNER_URI="${INPUT_SCANNERBINARIESURL%/}/$SCANNER_FILE_NAME"
2833

2934
if command -v wget &> /dev/null; then
30-
DOWNLOAD_COMMAND="wget"
31-
DOWNLOAD_ARGS="--no-verbose --user-agent=sonarqube-scan-action $SCANNER_URI"
35+
wget --no-verbose --user-agent=sonarqube-scan-action "$SCANNER_URI"
3236
elif command -v curl &> /dev/null; then
33-
DOWNLOAD_COMMAND="curl"
34-
DOWNLOAD_ARGS="--silent --show-error --user-agent sonarqube-scan-action --output $SCANNER_FILE_NAME $SCANNER_URI"
37+
curl --fail --silent --show-error --user-agent sonarqube-scan-action \
38+
--location --output "$SCANNER_FILE_NAME" "$SCANNER_URI"
3539
elif [ "$RUNNER_OS" == "Windows" ] && [ -t "C:\\msys64\\usr\\bin\\wget.exe" ]; then
36-
DOWNLOAD_COMMAND="C:\\msys64\\usr\\bin\\wget.exe"
37-
DOWNLOAD_ARGS="--no-verbose --user-agent=sonarqube-scan-action $SCANNER_URI"
40+
"C:\\msys64\\usr\\bin\\wget.exe" --no-verbose --user-agent=sonarqube-scan-action "$SCANNER_URI"
3841
elif [ "$RUNNER_OS" == "Windows" ] && [ -t "C:\\msys64\\usr\\bin\\curl.exe" ]; then
39-
DOWNLOAD_COMMAND="C:\\msys64\\usr\\bin\\curl.exe"
40-
DOWNLOAD_ARGS="--silent --show-error --user-agent sonarqube-scan-action --output $SCANNER_FILE_NAME $SCANNER_URI"
42+
"C:\\msys64\\usr\\bin\\curl.exe" --fail --silent --show-error --user-agent sonarqube-scan-action \
43+
--location --output "$SCANNER_FILE_NAME" "$SCANNER_URI"
4144
else
4245
echo "::error title=SonarScanner::Neither wget nor curl found on the machine"
4346
exit 1
4447
fi
4548

46-
set -x
47-
48-
mkdir -p $RUNNER_TEMP/sonarscanner
49-
cd $RUNNER_TEMP/sonarscanner
50-
51-
$DOWNLOAD_COMMAND $DOWNLOAD_ARGS
52-
5349
unzip -q $SCANNER_FILE_NAME
5450

5551
# Folder name should correspond to the directory cached by the actions/cache

0 commit comments

Comments
 (0)