Nemcio/Gogs
1
0
Fork 0
mirror of https://github.com/gogs/gogs.git synced 2026-03-06 12:11:00 +01:00
Code Issues Packages Projects Releases Wiki Activity

repo: disallow urlencoded new lines in git protocol paths (#6420)

Browse Source 
Co-authored-by: ᴜɴᴋɴᴡᴏɴ <u@gogs.io>
This commit is contained in:
stypr
2020-11-27 19:52:42 +09:00
committed by GitHub
parent c7f58ca870
commit cd469f7a1d
2 changed files with 6 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
internal/form/repo.go
View File

@@ -72,6 +72,10 @@ func (f MigrateRepo) ParseRemoteAddr(user *db.User) (string, error) {
if len(f.AuthUsername)+len(f.AuthPassword) > 0 {
u.User = url.UserPassword(f.AuthUsername, f.AuthPassword)
}
// To prevent CRLF injection in git protocol, see https://github.com/gogs/gogs/issues/6413
if u.Scheme == "git" && (strings.Contains(remoteAddr, "%0d") || strings.Contains(remoteAddr, "%0a")) {
return "", db.ErrInvalidCloneAddr{IsURLError: true}
}
remoteAddr = u.String()
} else if !user.CanImportLocal() {
return "", db.ErrInvalidCloneAddr{IsPermissionDenied: true}