New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

When redirecting, clean the path #5669

Merged
merged 2 commits into from Jan 9, 2019

Conversation

6 participants
@zeripath
Copy link
Contributor

zeripath commented Jan 8, 2019

Out of the box it is possible to get gitea to redirect to other servers:

$ curl -i --path-as-is http://localhost:3000//www.google.com/..
HTTP/1.1 302 Found
Content-Type: text/html; charset=utf-8
Location: //www.google.com/../
Date: Tue, 08 Jan 2019 21:53:05 GMT
Content-Length: 43

<a href="//www.google.com/../">Found</a>.

This PR cleans the path, prior to sending a http.Redirect.

Fix #5627

With thanks from @0x5c

Signed-off-by: Andrew Thornton art27@cantab.net

When redirecting clean the path to avoid redirecting to //www.othersi…
…te.com

Fix #5627

Signed-off-by: Andrew Thornton <art27@cantab.net>

@techknowlogick techknowlogick added this to the 1.8.0 milestone Jan 8, 2019

@codecov-io

This comment has been minimized.

Copy link

codecov-io commented Jan 8, 2019

Codecov Report

Merging #5669 into master will not change coverage.
The diff coverage is 0%.

Impacted file tree graph

@@           Coverage Diff           @@
##           master    #5669   +/-   ##
=======================================
  Coverage   37.77%   37.77%           
=======================================
  Files         323      323           
  Lines       47595    47595           
=======================================
  Hits        17977    17977           
  Misses      27029    27029           
  Partials     2589     2589
Impacted Files Coverage Δ
modules/public/public.go 74.41% <0%> (ø) ⬆️

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 0b84b5e...38d0693. Read the comment docs.

@bkcsoft bkcsoft added the lgtm/need 2 label Jan 8, 2019

@lunny

lunny approved these changes Jan 9, 2019

@bkcsoft bkcsoft added lgtm/need 1 and removed lgtm/need 2 labels Jan 9, 2019

@adelowo

adelowo approved these changes Jan 9, 2019

@bkcsoft bkcsoft added lgtm/done and removed lgtm/need 1 labels Jan 9, 2019

@techknowlogick techknowlogick merged commit dd13327 into go-gitea:master Jan 9, 2019

2 checks passed

approvals/lgtm this commit looks good
continuous-integration/drone/pr the build was successful
Details
@techknowlogick

This comment has been minimized.

Copy link
Member

techknowlogick commented Jan 9, 2019

@zeripath please backport

@zeripath zeripath deleted the zeripath:issue-5627-url-redirect-security-issue branch Jan 9, 2019

zeripath added a commit to zeripath/gitea that referenced this pull request Jan 9, 2019

techknowlogick added a commit that referenced this pull request Jan 9, 2019

When redirecting clean the path to avoid redirecting to //www.othersi…
…te.com (#5669) (#5679)

Fix #5627

Signed-off-by: Andrew Thornton <art27@cantab.net>
@lunny

This comment has been minimized.

Copy link
Member

lunny commented Jan 10, 2019

This should be also back port to release/v1.6

zeripath added a commit to zeripath/gitea that referenced this pull request Jan 11, 2019

techknowlogick added a commit that referenced this pull request Jan 12, 2019

When redirecting clean the path to avoid redirecting to //www.othersi…
…te.com (#5669) (#5703)

Fix #5627

Signed-off-by: Andrew Thornton <art27@cantab.net>

@jonasfranz jonasfranz referenced this pull request Jan 16, 2019

Merged

backport 1.6.4 to HEAD #5742

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment