fix: strip whitespace from publisher file paths (#18825)

* fix: strip whitespace from publisher file paths

Both GitHub and GitLab publisher forms accept inputs, and the filenames
are not validated against a regular expression at provision time.
This leads to folks entering values with leading whitespace, which can
be readily filtered out prior to validation.

Fixes #18820

Signed-off-by: Mike Fiedler <[email protected]>

* make translations

Signed-off-by: Mike Fiedler <[email protected]>

---------

Signed-off-by: Mike Fiedler <[email protected]>

Author: miketheman

tests/unit/oidc/forms/test_github.py

@@ -372,10 +372,27 @@ def test_validate_owner(self, monkeypatch):
         assert form.normalized_owner == "some-username"
         assert form.owner_id == "1234"
 
+    def test_validate_workflow_filename_strips_whitespace(self, monkeypatch):
+        data = MultiDict(
+            {
+                "owner": "some-owner",
+                "repository": "some-repo",
+                "workflow_filename": "  some-workflow.yml  ",
+            }
+        )
+        form = github.GitHubPublisherForm(MultiDict(data), api_token=pretend.stub())
+        owner_info = {"login": "fake-username", "id": "1234"}
+        monkeypatch.setattr(form, "_lookup_owner", lambda o: owner_info)
+
+        assert form.validate(), str(form.errors)
+        assert form.owner.data == "some-owner"
+        assert form.repository.data == "some-repo"
+        assert form.workflow_filename.data == "some-workflow.yml"
+
     @pytest.mark.parametrize(
         "workflow_filename", ["missing_suffix", "/slash", "/many/slashes", "/slash.yml"]
     )
-    def test_validate_workflow_filename(self, workflow_filename):
+    def test_validate_workflow_filename_raises(self, workflow_filename):
         form = github.GitHubPublisherForm(api_token=pretend.stub())
         field = pretend.stub(data=workflow_filename)
 

tests/unit/oidc/forms/test_gitlab.py

@@ -105,6 +105,12 @@ class TestGitLabPublisherForm:
                 "project": "some-repo",
                 "workflow_filepath": "subfolder/some-workflow.yml",
             },
+            # Leading/trailing whitespace is stripped from filepath
+            {
+                "namespace": "some-group/some-subgroup",
+                "project": "some-repo",
+                "workflow_filepath": "  subfolder/some-workflow.yml  ",
+            },
         ],
     )
     def test_validate(self, data):

warehouse/locale/messages.pot

@@ -771,55 +771,55 @@ msgstr ""
 msgid "Invalid repository name"
 msgstr ""
 
-#: warehouse/oidc/forms/github.py:39
+#: warehouse/oidc/forms/github.py:40
 msgid "Specify workflow filename"
 msgstr ""
 
-#: warehouse/oidc/forms/github.py:74
+#: warehouse/oidc/forms/github.py:75
 msgid "Unknown GitHub user or organization."
 msgstr ""
 
-#: warehouse/oidc/forms/github.py:85
+#: warehouse/oidc/forms/github.py:86
 msgid "GitHub has rate-limited this action. Try again in a few minutes."
 msgstr ""
 
-#: warehouse/oidc/forms/github.py:94
+#: warehouse/oidc/forms/github.py:95
 msgid "Unexpected error from GitHub. Try again."
 msgstr ""
 
-#: warehouse/oidc/forms/github.py:102
+#: warehouse/oidc/forms/github.py:103
 msgid "Unexpected connection error from GitHub. Try again in a few minutes."
 msgstr ""
 
-#: warehouse/oidc/forms/github.py:111
+#: warehouse/oidc/forms/github.py:112
 msgid "Unexpected timeout from GitHub. Try again in a few minutes."
 msgstr ""
 
-#: warehouse/oidc/forms/github.py:123
+#: warehouse/oidc/forms/github.py:124
 msgid "Invalid GitHub user or organization name."
 msgstr ""
 
-#: warehouse/oidc/forms/github.py:139
+#: warehouse/oidc/forms/github.py:140
 msgid "Workflow name must end with .yml or .yaml"
 msgstr ""
 
-#: warehouse/oidc/forms/github.py:144
+#: warehouse/oidc/forms/github.py:145
 msgid "Workflow filename must be a filename only, without directories"
 msgstr ""
 
-#: warehouse/oidc/forms/github.py:155
+#: warehouse/oidc/forms/github.py:156
 msgid "Environment name is too long (maximum is 255 characters)"
 msgstr ""
 
-#: warehouse/oidc/forms/github.py:160
+#: warehouse/oidc/forms/github.py:161
 msgid "Environment name may not start with whitespace"
 msgstr ""
 
-#: warehouse/oidc/forms/github.py:165
+#: warehouse/oidc/forms/github.py:166
 msgid "Environment name may not end with whitespace"
 msgstr ""
 
-#: warehouse/oidc/forms/github.py:171
+#: warehouse/oidc/forms/github.py:172
 msgid ""
 "Environment name must not contain non-printable characters or the "
 "characters \"'\", \"\"\", \"`\", \",\", \";\", \"\\\""
@@ -837,19 +837,19 @@ msgstr ""
 msgid "Invalid GitLab username or group/subgroup name."
 msgstr ""
 
-#: warehouse/oidc/forms/gitlab.py:62
+#: warehouse/oidc/forms/gitlab.py:63
 msgid "Specify top-level pipeline file path"
 msgstr ""
 
-#: warehouse/oidc/forms/gitlab.py:71
+#: warehouse/oidc/forms/gitlab.py:72
 msgid "Invalid environment name"
 msgstr ""
 
-#: warehouse/oidc/forms/gitlab.py:86
+#: warehouse/oidc/forms/gitlab.py:87
 msgid "Top-level pipeline file path must end with .yml or .yaml"
 msgstr ""
 
-#: warehouse/oidc/forms/gitlab.py:90
+#: warehouse/oidc/forms/gitlab.py:91
 msgid "Top-level pipeline file path cannot start or end with /"
 msgstr ""
 

warehouse/oidc/forms/github.py

@@ -35,9 +35,10 @@ class GitHubPublisherBase(wtforms.Form):
     )
 
     workflow_filename = wtforms.StringField(
+        filters=[lambda x: x.strip() if x else x],
         validators=[
             wtforms.validators.InputRequired(message=_("Specify workflow filename"))
-        ]
+        ],
     )
 
     # Environment names are not case sensitive. An environment name may not

warehouse/oidc/forms/gitlab.py

@@ -57,11 +57,12 @@ class GitLabPublisherBase(wtforms.Form):
     )
 
     workflow_filepath = wtforms.StringField(
+        filters=[lambda x: x.strip() if x else x],
         validators=[
             wtforms.validators.InputRequired(
                 message=_("Specify top-level pipeline file path")
             )
-        ]
+        ],
     )
 
     environment = wtforms.StringField(