CVE-2020-29662

@@ -27,5 +27,5 @@ var (
 	// V2BlobUploadURLRe is the regular expression for matching the request to v2 handler to upload a blob, the upload uuid currently is not put into a group
 	V2BlobUploadURLRe = regexp.MustCompile(fmt.Sprintf(`^/v2/(?P<%s>%s)/blobs/uploads[/a-zA-Z0-9\-_\.=]*$`, RepositorySubexp, reference.NameRegexp.String()))
 	// V2CatalogURLRe is the regular expression for mathing the request to v2 handler to list catalog
-	V2CatalogURLRe = regexp.MustCompile(`^/v2/_catalog$`)
+	V2CatalogURLRe = regexp.MustCompile(`^/v2/_catalog/?$`)
 )

@@ -0,0 +1,44 @@
+// Copyright Project Harbor Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//    http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package middleware
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestMatchCatalogURLPattern(t *testing.T) {
+	cases := []struct {
+		url   string
+		match bool
+	}{
+		{
+			url:   "/v2/_catalog",
+			match: true,
+		},
+		{
+			url:   "/v2/_catalog/",
+			match: true,
+		},
+		{
+			url:   "/v2/_catalog/xxx",
+			match: false,
+		},
+	}
+	for _, c := range cases {
+		assert.Equal(t, c.match, len(V2CatalogURLRe.FindStringSubmatch(c.url)) == 1)
+	}
+}

@@ -27,7 +27,7 @@ var (
 	// V2BlobUploadURLRe is the regular expression for matching the request to v2 handler to upload a blob, the upload uuid currently is not put into a group
 	V2BlobUploadURLRe = regexp.MustCompile(fmt.Sprintf(`^/v2/(?P<%s>%s)/blobs/uploads[/a-zA-Z0-9\-_\.=]*$`, RepositorySubexp, reference.NameRegexp.String()))
 	// V2CatalogURLRe is the regular expression for mathing the request to v2 handler to list catalog
-	V2CatalogURLRe = regexp.MustCompile(`^/v2/_catalog$`)
+	V2CatalogURLRe = regexp.MustCompile(`^/v2/_catalog/?$`)
 )
 
 // MatchManifestURLPattern checks whether the provided path matches the manifest URL pattern,

@@ -66,3 +66,26 @@ func TestMatchBlobUploadURLPattern(t *testing.T) {
 	assert.True(t, ok)
 	assert.Equal(t, "library/hello-world", repository)
 }
+
+func TestMatchCatalogURLPattern(t *testing.T) {
+	cases := []struct {
+		url   string
+		match bool
+	}{
+		{
+			url:   "/v2/_catalog",
+			match: true,
+		},
+		{
+			url:   "/v2/_catalog/",
+			match: true,
+		},
+		{
+			url:   "/v2/_catalog/xxx",
+			match: false,
+		},
+	}
+	for _, c := range cases {
+		assert.Equal(t, c.match, len(V2CatalogURLRe.FindStringSubmatch(c.url)) == 1)
+	}
+}