[v11.0/forgejo] fix: validate input for default_{merge,update}_style (#7401)

**Backport:** https://codeberg.org/forgejo/forgejo/pulls/7395

- Add `binding:"In(...)"` to the `default_merge_style` and `default_update_style` fields to only accept recognized merge and update styles.
- Resolves forgejo/forgejo#7389
- Added integration test for the API (`binding` works in the exact same way for the API and web routes).

Co-authored-by: Gusted <postmaster@gusted.xyz>
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/7401
Reviewed-by: Earl Warren <earl-warren@noreply.codeberg.org>
Co-authored-by: forgejo-backport-action <forgejo-backport-action@noreply.codeberg.org>
Co-committed-by: forgejo-backport-action <forgejo-backport-action@noreply.codeberg.org>

modules/structs/repo.go

@@ -224,10 +224,10 @@ type EditRepoOption struct {
 	AllowRebaseUpdate *bool `json:"allow_rebase_update,omitempty"`
 	// set to `true` to delete pr branch after merge by default
 	DefaultDeleteBranchAfterMerge *bool `json:"default_delete_branch_after_merge,omitempty"`
-	// set to a merge style to be used by this repository: "merge", "rebase", "rebase-merge", "squash", or "fast-forward-only".
-	DefaultMergeStyle *string `json:"default_merge_style,omitempty"`
+	// set to a merge style to be used by this repository: "merge", "rebase", "rebase-merge", "squash", "fast-forward-only", "manually-merged", or "rebase-update-only".
+	DefaultMergeStyle *string `json:"default_merge_style,omitempty" binding:"In(merge,rebase,rebase-merge,squash,fast-forward-only,manually-merged,rebase-update-only)"`
 	// set to a update style to be used by this repository: "rebase" or "merge"
-	DefaultUpdateStyle *string `json:"default_update_style,omitempty"`
+	DefaultUpdateStyle *string `json:"default_update_style,omitempty" binding:"In(merge,rebase)"`
 	// set to `true` to allow edits from maintainers by default
 	DefaultAllowMaintainerEdit *bool `json:"default_allow_maintainer_edit,omitempty"`
 	// set to `true` to archive this repository.

routers/web/repo/setting/setting.go

@@ -105,6 +105,10 @@ func Units(ctx *context.Context) {
 
 func UnitsPost(ctx *context.Context) {
 	form := web.GetForm(ctx).(*forms.RepoUnitSettingForm)
+	if ctx.HasError() {
+		ctx.Redirect(ctx.Repo.Repository.Link() + "/settings/units")
+		return
+	}
 
 	repo := ctx.Repo.Repository
 

services/forms/repo_form.go

@@ -188,8 +188,8 @@ type RepoUnitSettingForm struct {
 	PullsAllowSquash                      bool
 	PullsAllowFastForwardOnly             bool
 	PullsAllowManualMerge                 bool
-	PullsDefaultMergeStyle                string
-	PullsDefaultUpdateStyle               string
+	PullsDefaultMergeStyle                string `binding:"In(merge,rebase,rebase-merge,squash,fast-forward-only,manually-merged,rebase-update-only)"`
+	PullsDefaultUpdateStyle               string `binding:"In(merge,rebase)"`
 	EnableAutodetectManualMerge           bool
 	PullsAllowRebaseUpdate                bool
 	DefaultDeleteBranchAfterMerge         bool

templates/swagger/v1_json.tmpl

@@ -23762,7 +23762,7 @@
           "x-go-name": "DefaultDeleteBranchAfterMerge"
         },
         "default_merge_style": {
-          "description": "set to a merge style to be used by this repository: \"merge\", \"rebase\", \"rebase-merge\", \"squash\", or \"fast-forward-only\".",
+          "description": "set to a merge style to be used by this repository: \"merge\", \"rebase\", \"rebase-merge\", \"squash\", \"fast-forward-only\", \"manually-merged\", or \"rebase-update-only\".",
           "type": "string",
           "x-go-name": "DefaultMergeStyle"
         },

tests/integration/api_repo_edit_test.go

@@ -6,7 +6,6 @@ package integration
 import (
 	"fmt"
 	"net/http"
-	"net/url"
 	"testing"
 
 	auth_model "forgejo.org/models/auth"
@@ -16,6 +15,7 @@ import (
 	"forgejo.org/models/unittest"
 	user_model "forgejo.org/models/user"
 	api "forgejo.org/modules/structs"
+	"forgejo.org/tests"
 
 	"github.com/stretchr/testify/assert"
 )
@@ -137,7 +137,7 @@ func getNewRepoEditOption(opts *api.EditRepoOption) *api.EditRepoOption {
 }
 
 func TestAPIRepoEdit(t *testing.T) {
-	onGiteaRun(t, func(t *testing.T, u *url.URL) {
+	defer tests.PrepareTestEnv(t)()
 	bFalse, bTrue := false, true
 
 	user2 := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 2})         // owner of the repo1 & repo16
@@ -364,5 +364,33 @@ func TestAPIRepoEdit(t *testing.T) {
 	req = NewRequestWithJSON(t, "PATCH", fmt.Sprintf("/api/v1/repos/%s/%s", user2.Name, repo1.Name), &repoEditOption).
 		AddTokenAuth(token4)
 	MakeRequest(t, req, http.StatusForbidden)
+
+	t.Run("Default merge style", func(t *testing.T) {
+		defer tests.PrintCurrentTest(t)()
+
+		updateStyle := "invalid"
+		MakeRequest(t, NewRequestWithJSON(t, "PATCH", url, &api.EditRepoOption{
+			DefaultUpdateStyle: &updateStyle,
+		}).AddTokenAuth(token2), http.StatusUnprocessableEntity)
+
+		MakeRequest(t, NewRequestWithJSON(t, "PATCH", url, &api.EditRepoOption{
+			DefaultMergeStyle: &updateStyle,
+		}).AddTokenAuth(token2), http.StatusUnprocessableEntity)
+
+		var apiRepo api.Repository
+		DecodeJSON(t, MakeRequest(t, NewRequest(t, "GET", url).AddTokenAuth(token2), http.StatusOK), &apiRepo)
+		assert.Equal(t, "merge", apiRepo.DefaultMergeStyle)
+		assert.Equal(t, "merge", apiRepo.DefaultUpdateStyle)
+
+		updateStyle = "rebase"
+		MakeRequest(t, NewRequestWithJSON(t, "PATCH", url, &api.EditRepoOption{
+			DefaultMergeStyle:  &updateStyle,
+			DefaultUpdateStyle: &updateStyle,
+			HasPullRequests:    &bTrue,
+		}).AddTokenAuth(token2), http.StatusOK)
+
+		DecodeJSON(t, MakeRequest(t, NewRequest(t, "GET", url).AddTokenAuth(token2), http.StatusOK), &apiRepo)
+		assert.Equal(t, "rebase", apiRepo.DefaultMergeStyle)
+		assert.Equal(t, "rebase", apiRepo.DefaultUpdateStyle)
 	})
 }