Lunny Xiao 3db3c058b3 Prevent redirect bypasses via backslash-encoded paths (#36660) ...

This change tightens relative URL validation to reject raw backslashes
and `%5c` (encoded backslash), since browsers and URL normalizers can
treat backslashes as path separators. That normalization can turn
seemingly relative paths into scheme-relative URLs, creating
open-redirect risk.

Visiting below URL to reproduce the problem.

http://localhost:3000/user/login?redirect_to=/a/../\example.com

http://localhost:3000/user/login?redirect_to=/a/../%5cexample.com

---------

Co-authored-by: silverwind <me@silverwind.io>
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>

2026-02-22 22:15:03 +00:00

..

actions

Move jobparser from act repository to Gitea (#36699)

2026-02-22 19:33:01 +00:00

activitypub

Remove incorrect "db.DefaultContext" usages (#35366)

2025-08-28 03:52:43 +00:00

analyze

Fix incorrect vendored detections (#36508)

2026-02-01 10:35:51 +00:00

assetfs

Refactor template render (#36438)

2026-01-24 05:11:49 +00:00

auth

Fix oauth2 session gob register (#36017)

2025-11-26 23:25:34 +08:00

avatar

Fix various typos in codebase (#35480)

2025-09-13 10:34:43 -04:00

badge

Add flat-square action badge style (#34062)

2025-04-01 09:42:10 +00:00

base

Refactor ls-tree and git path related problems (#35858)

2025-11-05 17:48:38 +00:00

cache

enforce explanation for necessary nolints and fix bugs (#34883)

2025-06-27 21:48:03 +08:00

cachegroup

Cache GPG keys, emails and users when list commits (#34086)

2025-04-09 16:34:38 +00:00

charset

Fix code highlighting on blame page (#36157)

2025-12-14 12:40:55 +02:00

commitstatus

enforce nolint scope (#34851)

2025-06-27 07:59:55 +02:00

container

Refactor sidebar assignee&milestone&project selectors (#32465)

2024-11-11 04:07:54 +08:00

csv

Disable Field count validation of CSV viewer (#35228)

2025-09-04 09:54:58 -07:00

dump

Use github.com/mholt/archives replace github.com/mholt/archiver (#35390)

2025-09-01 19:40:12 +00:00

emoji

Update emoji data for Unicode 16 (#36596)

2026-02-12 21:39:36 +00:00

eventsource

Add more check for stopwatch read or list (#36340)

2026-01-13 13:13:39 +00:00

fileicon

Add FOLDER_ICON_THEME configuration option (#36496)

2026-01-30 20:48:56 +00:00

generate

Refactor JWT secret generating & decoding code (#29172)

2024-02-16 15:18:30 +00:00

git

Clean up Makefile, tests and legacy code (#36638)

2026-02-19 01:23:32 +00:00

gitrepo

Clean up Makefile, tests and legacy code (#36638)

2026-02-19 01:23:32 +00:00

glob

Replace gobwas/glob package (#35478)

2025-09-13 18:01:00 +00:00

globallock

Upgrade golang to 1.25.1 and add descriptions for the swagger structs' fields (#35418)

2025-09-06 16:52:41 +00:00

graceful

Enable nilnil linter for new code (#36591)

2026-02-16 09:57:18 +00:00

gtprof

Add start time on perf trace because it seems some steps haven't been recorded. (#35282)

2025-08-18 15:17:19 +00:00

hcaptcha

Clean up Makefile, tests and legacy code (#36638)

2026-02-19 01:23:32 +00:00

highlight

Fix chroma lexer mapping (#36629)

2026-02-16 02:11:02 +00:00

hostmatcher

Run gopls modernize on codebase (#34751)

2025-06-18 01:48:09 +00:00

htmlutil

Fix markup heading parsing, fix emphasis parsing (#36284)

2026-01-23 20:24:58 +00:00

httpcache

Run gopls modernize on codebase (#34751)

2025-06-18 01:48:09 +00:00

httplib

Prevent redirect bypasses via backslash-encoded paths (#36660)

2026-02-22 22:15:03 +00:00

indexer

Refactor highlight and diff (#36599)

2026-02-13 00:15:46 +00:00

issue/template

Limit reading bytes instead of ReadAll (#35928)

2025-11-12 19:44:49 +08:00

json

Drop json-iterator dependency (#35544)

2025-09-28 22:30:28 +08:00

label

Run gopls modernize on codebase (#34751)

2025-06-18 01:48:09 +00:00

lfs

Refactor git command stdio pipe (#36422)

2026-01-22 06:04:26 +00:00

lfstransfer

Fix missing Close when error occurs and abused connection pool (#35658)

2025-10-15 09:47:12 +00:00

log

Refactor git command context & pipeline (#36406)

2026-01-21 01:35:14 +00:00

markup

Only turn links to current instance into hash links (#36237)

2026-02-16 10:27:49 +00:00

mcaptcha

Implement FSFE REUSE for golang files (#21840)

2022-11-27 18:20:29 +00:00

metrics

Remove incorrect "db.DefaultContext" usages (#35366)

2025-08-28 03:52:43 +00:00

migration

fix: prevent panic when GitLab release has more links than sources (#36295)

2026-01-05 21:48:12 +08:00

nosql

Refactor git command context & pipeline (#36406)

2026-01-21 01:35:14 +00:00

optional

Enable nilnil linter for new code (#36591)

2026-02-16 09:57:18 +00:00

options

Refactor embedded assets and drop unnecessary dependencies (#34692)

2025-06-12 03:59:33 +00:00

packages

Fix various version parsing problems (#36553)

2026-02-08 20:25:30 +00:00

paginator

Only use prev and next buttons for pagination on user dashboard (#33981)

2025-03-23 19:52:43 +00:00

pprof

Implement FSFE REUSE for golang files (#21840)

2022-11-27 18:20:29 +00:00

private

Fix missing Close when error occurs and abused connection pool (#35658)

2025-10-15 09:47:12 +00:00

process

Refactor git command context & pipeline (#36406)

2026-01-21 01:35:14 +00:00

proxy

Replace gobwas/glob package (#35478)

2025-09-13 18:01:00 +00:00

proxyprotocol

Enable addtional linters (#34085)

2025-04-01 10:14:01 +00:00

public

Refactor template render (#36438)

2026-01-24 05:11:49 +00:00

queue

Refactor git command context & pipeline (#36406)

2026-01-21 01:35:14 +00:00

recaptcha

Implement FSFE REUSE for golang files (#21840)

2022-11-27 18:20:29 +00:00

references

Support closing keywords with URL references (#36221)

2025-12-27 09:05:24 -08:00

regexplru

Enable testifylint rules (#34075)

2025-03-31 01:53:48 -04:00

repository

Fix mirror sync parser and fix mirror messages (#36504)

2026-02-11 00:16:05 +00:00

reqctx

Run gopls modernize on codebase (#34751)

2025-06-18 01:48:09 +00:00

secret

Upgrade golangci-lint to v1.64.5 (#33654)

2025-02-21 00:05:40 +08:00

session

Clean up Makefile, tests and legacy code (#36638)

2026-02-19 01:23:32 +00:00

setting

Move X_FRAME_OPTIONS setting from cors to security section (#30256)

2026-02-22 20:26:46 +00:00

sitemap

Fix sitemap (#22272)

2022-12-30 23:31:00 +08:00

ssh

Update x/crypto package and make builtin SSH use default parameters (#34667)

2025-06-09 19:51:02 +00:00

storage

Allow to display embed images/pdfs when SERVE_DIRECT was enabled on MinIO storage (#35882)

2025-11-09 21:31:25 -08:00

structs

Allow configuring default PR base branch (fixes #36412) (#36425)

2026-02-07 01:34:29 +00:00

svg

Support selecting theme on the footer (#35741)

2025-10-28 18:25:00 +08:00

system

Remove incorrect "db.DefaultContext" usages (#35366)

2025-08-28 03:52:43 +00:00

tailmsg

Support performance trace (#32973)

2025-01-21 18:57:07 +00:00

tempdir

Address some CodeQL security concerns (#35572)

2025-10-04 01:21:26 +08:00

templates

Use relative-time to render absolute dates (#36238)

2026-02-16 10:58:04 +00:00

test

Fix various version parsing problems (#36553)

2026-02-08 20:25:30 +00:00

testlogger

Clean up Makefile, tests and legacy code (#36638)

2026-02-19 01:23:32 +00:00

timeutil

Clean up Makefile, tests and legacy code (#36638)

2026-02-19 01:23:32 +00:00

translation

Use flatten translation keys (#36225)

2025-12-25 12:51:33 -08:00

turnstile

Add new captcha: cloudflare turnstile (#22369)

2023-02-05 15:29:03 +08:00

typesniffer

Fix incorrect text content detection (#36364)

2026-01-14 23:35:52 +08:00

updatechecker

Enable addtional linters (#34085)

2025-04-01 10:14:01 +00:00

uri

Implement FSFE REUSE for golang files (#21840)

2022-11-27 18:20:29 +00:00

user

Refactor older tests to use testify (#33140)

2025-01-09 09:21:47 +08:00

util

feat(db): Improve BuildCaseInsensitiveLike with lowercase (#36598)

2026-02-14 07:40:59 +00:00

validation

Update tool dependencies (#36445)

2026-01-24 09:58:28 +01:00

web

Update to go 1.26.0 and golangci-lint 2.9.0 (#36588)

2026-02-11 18:37:13 +01:00

webhook

actions: report commit status for pull_request_review events (#36589)

2026-02-20 16:12:22 +00:00

zstd

Refactor embedded assets and drop unnecessary dependencies (#34692)

2025-06-12 03:59:33 +00:00