Gitea-John71/Gitea
2
0
Fork 0
mirror of https://github.com/go-gitea/gitea.git synced 2026-08-24 05:19:50 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(actions): verify raw artifact signatures first (#39049)

Browse Source 
Validate raw-artifact signatures before resolving the requested
artifact.

---------

Co-authored-by: silverwind <me@silverwind.io>
This commit is contained in:
bircni
2026-08-22 20:47:55 +02:00
committed by GitHub
parent 51e42d4b11
commit 5fc3cec87f
2 changed files with 38 additions and 38 deletions
Download Patch File Download Diff File Expand all files Collapse all files
routers/api/v1/repo/action.go
+19 -20
View File
@@ -2077,8 +2077,8 @@ func buildSignature(endp string, expires, artifactID int64) []byte {
return actions.BuildSignature("api", endp, strconv.FormatInt(expires, 10), strconv.FormatInt(artifactID, 10))
}
func buildDownloadRawEndpoint(repo *repo_model.Repository, artifactID int64) string {
return fmt.Sprintf("api/v1/repos/%s/%s/actions/artifacts/%d/zip/raw", url.PathEscape(repo.OwnerName), url.PathEscape(repo.Name), artifactID)
func buildDownloadRawEndpoint(ownerName, repoName string, artifactID int64) string {
return fmt.Sprintf("api/v1/repos/%s/%s/actions/artifacts/%d/zip/raw", url.PathEscape(ownerName), url.PathEscape(repoName), artifactID)
}
func buildSigURL(ctx go_context.Context, endPoint string, artifactID int64) string {
@@ -2139,7 +2139,7 @@ func DownloadArtifact(ctx *context.APIContext) {
// @actions/toolkit asserts a 302 for the artifact download, so we have to build a signed URL and redirect to it
// TODO: a perma link to the code for reference
redirectURL := buildSigURL(ctx, buildDownloadRawEndpoint(ctx.Repo.Repository, art.ID), art.ID)
redirectURL := buildSigURL(ctx, buildDownloadRawEndpoint(ctx.Repo.Repository.OwnerName, ctx.Repo.Repository.Name, art.ID), art.ID)
ctx.Redirect(redirectURL, http.StatusFound)
return
}
@@ -2150,7 +2150,22 @@ func DownloadArtifact(ctx *context.APIContext) {
// DownloadArtifactRaw Downloads a specific artifact for a workflow run directly.
func DownloadArtifactRaw(ctx *context.APIContext) {
// it doesn't use repoAssignment middleware, so it needs to prepare the repo and check permission (sig) by itself
repo, err := repo_model.GetRepositoryByOwnerAndName(ctx, ctx.PathParam("username"), ctx.PathParam("reponame"))
ownerName, repoName := ctx.PathParam("username"), ctx.PathParam("reponame")
query := ctx.Req.URL.Query()
sigBytes, _ := base64.RawURLEncoding.DecodeString(query.Get("sig"))
expires, _ := strconv.ParseInt(query.Get("expires"), 10, 64)
artifactID := ctx.PathParamInt64("artifact_id")
if !hmac.Equal(sigBytes, buildSignature(buildDownloadRawEndpoint(ownerName, repoName, artifactID), expires, artifactID)) {
ctx.APIErrorNotFound()
return
}
if time.Unix(expires, 0).Before(time.Now()) {
ctx.APIError(http.StatusUnauthorized, "Error link expired")
return
}
repo, err := repo_model.GetRepositoryByOwnerAndName(ctx, ownerName, repoName)
if err != nil {
if errors.Is(err, util.ErrNotExist) {
ctx.APIErrorNotFound()
@@ -2164,22 +2179,6 @@ func DownloadArtifactRaw(ctx *context.APIContext) {
return
}
sigStr := ctx.Req.URL.Query().Get("sig")
expiresStr := ctx.Req.URL.Query().Get("expires")
sigBytes, _ := base64.RawURLEncoding.DecodeString(sigStr)
expires, _ := strconv.ParseInt(expiresStr, 10, 64)
expectedSig := buildSignature(buildDownloadRawEndpoint(repo, art.ID), expires, art.ID)
if !hmac.Equal(sigBytes, expectedSig) {
ctx.APIError(http.StatusUnauthorized, "Error unauthorized")
return
}
t := time.Unix(expires, 0)
if t.Before(time.Now()) {
ctx.APIError(http.StatusUnauthorized, "Error link expired")
return
}
// if artifacts status is not uploaded-confirmed, treat it as not found
if art.Status == actions_model.ArtifactStatusExpired {
ctx.APIError(http.StatusNotFound, "Artifact has expired")