New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

SECURITY: prevent DeleteFilePost doing arbitrary deletion #5631

Merged
merged 1 commit into from Jan 4, 2019

Conversation

@zeripath
Copy link
Contributor

zeripath commented Jan 4, 2019

Unfortunately a suitably malformed request to DeleteFilePost will allow arbitrary deletion. Further it was also possible to adjust the .git directories on editFilePost and UploadFilePost.

@codecov-io

This comment has been minimized.

Copy link

codecov-io commented Jan 4, 2019

Codecov Report

❗️ No coverage uploaded for pull request base (master@5a1ea37). Click here to learn what that means.
The diff coverage is 6.25%.

Impacted file tree graph

@@            Coverage Diff            @@
##             master    #5631   +/-   ##
=========================================
  Coverage          ?   37.81%           
=========================================
  Files             ?      322           
  Lines             ?    47485           
  Branches          ?        0           
=========================================
  Hits              ?    17957           
  Misses            ?    26939           
  Partials          ?     2589
Impacted Files Coverage Δ
routers/repo/editor.go 29.01% <6.25%> (ø)

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 5a1ea37...d87fcfc. Read the comment docs.

@jonasfranz

This comment has been minimized.

Copy link
Member

jonasfranz commented Jan 4, 2019

@go-gitea/owners I think we have to backport this to 1.6 since this is quite critical IMHO.

Show resolved Hide resolved routers/repo/editor.go
SECURITY: protect DeleteFilePost et al with cleanUploadFileName
    This commit wraps more of the TreePaths with cleanUploadFileName

Signed-off-by: Andrew Thornton <art27@cantab.net>

@zeripath zeripath force-pushed the zeripath:protect-delete-file branch from 9663346 to d87fcfc Jan 4, 2019

@bkcsoft bkcsoft added lgtm/need 1 and removed lgtm/need 2 labels Jan 4, 2019

@bkcsoft bkcsoft added lgtm/done and removed lgtm/need 1 labels Jan 4, 2019

@techknowlogick techknowlogick merged commit fd1e856 into go-gitea:master Jan 4, 2019

2 checks passed

approvals/lgtm this commit looks good
continuous-integration/drone/pr the build was successful
Details
@techknowlogick

This comment has been minimized.

Copy link
Member

techknowlogick commented Jan 4, 2019

@zeripath thanks for PR :) as @jonasfranz has said, please backport to both release/v1.7 and release/v1.6

@zeripath zeripath deleted the zeripath:protect-delete-file branch Jan 4, 2019

zeripath added a commit to zeripath/gitea that referenced this pull request Jan 4, 2019

SECURITY: protect DeleteFilePost et al with cleanUploadFileName (go-g…
…itea#5631)

This commit wraps more of the TreePaths with cleanUploadFileName

Signed-off-by: Andrew Thornton <art27@cantab.net>

zeripath added a commit to zeripath/gitea that referenced this pull request Jan 4, 2019

SECURITY: protect DeleteFilePost et al with cleanUploadFileName (go-g…
…itea#5631)

This commit wraps more of the TreePaths with cleanUploadFileName

Signed-off-by: Andrew Thornton <art27@cantab.net>

jonasfranz added a commit that referenced this pull request Jan 4, 2019

SECURITY: protect DeleteFilePost et al with cleanUploadFileName (#5631)…
… (#5634)

This commit wraps more of the TreePaths with cleanUploadFileName

Signed-off-by: Andrew Thornton <art27@cantab.net>

jonasfranz added a commit that referenced this pull request Jan 4, 2019

SECURITY: protect DeleteFilePost et al with cleanUploadFileName (#5631)…
… (#5635)

This commit wraps more of the TreePaths with cleanUploadFileName

Signed-off-by: Andrew Thornton <art27@cantab.net>

@lafriks lafriks modified the milestones: 1.7.0, 1.8.0 Jan 4, 2019

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment