fix(web): don't block README images with REQUIRE_SIGNIN_VIEW = expensive (#40264)

Relax expensive endpoint list, then README can render its images.

---------

Signed-off-by: wxiaoguang <wxiaoguang@gmail.com>
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>

routers/common/blockexpensive.go

@@ -39,20 +39,22 @@ func isRoutePathExpensive(routePattern string) bool {
 		return false
 	}
 
+	// an endpoint is expensive if crawlers could consume a lot of resources by accessing it
 	expensivePaths := []string{
 		// code related
+		// media and raw endpoints are for single file accesses and useful for rendering README images, not that expensive
+		// the single file endpoints won't be accessed by crawlers as long as the commits/files endpoints are protected from crawlers
 		"/{username}/{reponame}/archive/",
 		"/{username}/{reponame}/blame/",
 		"/{username}/{reponame}/commit/",
 		"/{username}/{reponame}/commits/",
 		"/{username}/{reponame}/compare/",
 		"/{username}/{reponame}/graph",
-		"/{username}/{reponame}/media/",
-		"/{username}/{reponame}/raw/",
 		"/{username}/{reponame}/rss/branch/",
 		"/{username}/{reponame}/src/",
 
 		// issue & PR related (no trailing slash)
+		// because it would cause heavy database queries, and PR pages need to load a lot of git data
 		"/{username}/{reponame}/issues",
 		"/{username}/{reponame}/{type:issues}",
 		"/{username}/{reponame}/pulls",

tests/integration/signin_test.go

@@ -188,6 +188,11 @@ func TestRequireSignInView(t *testing.T) {
 		req = NewRequest(t, "GET", "/user2/repo1/src/branch/master")
 		resp := MakeRequest(t, req, http.StatusSeeOther)
 		assert.Equal(t, "/user/login?redirect_to=%2Fuser2%2Frepo1%2Fsrc%2Fbranch%2Fmaster", resp.Header().Get("Location"))
+
+		req = NewRequest(t, "GET", "/user2/repo1/media/branch/master/README.md")
+		MakeRequest(t, req, http.StatusOK)
+		req = NewRequest(t, "GET", "/user2/repo1/raw/commit/65f1bf27bc3bf70f64657658635e66094edbcb4d/README.md")
+		MakeRequest(t, req, http.StatusOK)
 	})
 }