Gitea-John71/Gitea
2
0
Fork 0
mirror of https://github.com/go-gitea/gitea.git synced 2026-08-04 04:57:25 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix: various security fixes (#38406)

Browse Source 
Addresses a batch of privately reported security issues, grouped by
area:

- **SSRF** - migration PR-patch/asset fetches, OAuth2 avatar & OpenID
discovery, pull-mirror URL re-validation, and the outbound proxy path.
- **Access-token scope** - prevent scope escalation on token creation;
keep public-only tokens confined (feeds, packages, Actions listings,
star/watch lists, limited/private owners).
- **Access control / disclosure** - go-get default-branch leak, webhook
authorization-header leak, watch clearing on private transitions,
label/attachment scoping.
- **Denial of service** - input bounds for npm dist-tags, Debian control
files, Arch file lists, and SSH keys.

### 📌 Attention for site admins

Not breaking - existing configs keep working - but two changes are worth
a look:

- **New SSRF protection** Outbound requests (migrations, OAuth2 avatars,
OpenID discovery, pull mirrors, proxy path) are now validated against
the allow/block host lists. If your instance legitimately reaches
internal hosts, you may need to add them to
`[security].ALLOWED_HOST_LIST` (and the relevant `ALLOW_LOCALNETWORKS`
settings).
- **Deprecation** `[webhook].ALLOWED_HOST_LIST` is deprecated and will
be removed in a future release. Use `[security].ALLOWED_HOST_LIST`
instead; the old key still works for now.

---------

Co-authored-by: TheFox0x7 <thefox0x7@gmail.com>
Co-authored-by: techknowlogick <techknowlogick@gitea.io>
Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
Co-authored-by: Zettat123 <zettat123@gmail.com>
This commit is contained in:
bircni
2026-07-12 19:14:09 +02:00
committed by GitHub
parent d2bd1589fe
commit f69e15afe7
93 changed files with 1715 additions and 138 deletions
Download Patch File Download Diff File Expand all files Collapse all files
services/projects/issue_test.go
+18 -1
View File
@@ -24,6 +24,9 @@ func Test_Projects(t *testing.T) {
user2 := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 2})
org3 := unittest.AssertExistsAndLoadBean(t, &org_model.Organization{ID: 3})
user4 := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 4})
// user15 is on org3's team7 (write access to the public repo32 only), so it can see org3 public repos
// but has no access to the private repo3 — a genuine "no permission to the private repo" org member.
user15 := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 15})
t.Run("User projects", func(t *testing.T) {
pi1 := project_model.ProjectIssue{
@@ -142,13 +145,27 @@ func Test_Projects(t *testing.T) {
})
t.Run("Authenticated user with no permission to the private repo", func(t *testing.T) {
// user2 is on org3's Owners team and has owner access to the private repo3, so it is not a
// valid "no permission" subject; user15 has no access to repo3 but can see the public repo32.
columnIssues, err := LoadIssuesFromProject(t.Context(), projects[0], &issues_model.IssuesOptions{
Owner: org3.AsUser(),
Doer: user15,
})
assert.NoError(t, err)
assert.Len(t, columnIssues, 1)
assert.Len(t, columnIssues[defaultColumn.ID], 1) // user15 can only visit public repo issues
})
t.Run("Org owner team member", func(t *testing.T) {
// user2 is on org3's Owners team, so it has access to the private repo3 and must see both the
// public and the private issue — the owner-team access that team.authorize grants at runtime.
columnIssues, err := LoadIssuesFromProject(t.Context(), projects[0], &issues_model.IssuesOptions{
Owner: org3.AsUser(),
Doer: user2,
})
assert.NoError(t, err)
assert.Len(t, columnIssues, 1)
assert.Len(t, columnIssues[defaultColumn.ID], 1) // user2 can only visit public repo issues
assert.Len(t, columnIssues[defaultColumn.ID], 2) // owner-team member visits both public and private issues
})
})