Giteabot
af7ba2edef
fix: enforce public-only token scope and harden push options / locale parsing ( #38323 ) ( #38399 )
...
Backport #38323 by @bircni
Three independent security hardening fixes, each with a regression test:
- **Locale DoS:** the `Locale` middleware passed the raw
`Accept-Language` header to `ParseAcceptLanguage`, whose guard only
counts `-` while the scanner aliases `_` to `-` — a large `_`-separated
header on an unauthenticated request burned CPU. The header is now
length-bounded before parsing.
- **Public-only token scope:** `GET /teams/{id}/repos`,
`.../repos/{org}/{repo}`, `/teams/{id}/activities/feeds`, and
`/users/{username}/orgs/{org}/permissions` still returned private
repo/activity/permission data to a public-only token. They now filter
via `TokenCanAccessRepo` / `ApplyPublicOnly` and reject non-public org
permissions.
- **Push-option visibility:** `repo.private` / `repo.template` push
options were applied to any existing repo, letting an owner/admin
silently flip visibility bypassing audit, webhooks, and notifications.
They are now honored only on push-to-create.
Co-authored-by: bircni <bircni@icloud.com >
2026-07-10 19:07:04 +02:00
..
2026-04-23 15:18:53 +00:00
2026-05-26 15:49:31 -07:00
2026-06-08 20:07:15 +00:00
2026-06-08 20:07:15 +00:00
2026-06-27 17:56:12 +00:00
2026-05-27 16:23:44 -07:00
2026-05-26 15:49:31 -07:00
2026-05-27 16:23:44 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-28 05:19:46 +02:00
2026-05-27 16:23:44 -07:00
2026-05-27 16:23:44 -07:00
2026-05-30 08:31:14 +02:00
2026-06-08 19:11:00 +00:00
2026-05-29 22:16:47 +02:00
2026-05-27 16:23:44 -07:00
2026-05-26 15:49:31 -07:00
2026-07-01 20:10:11 +00:00
2026-05-26 15:49:31 -07:00
2026-07-09 15:58:46 +00:00
2026-05-26 15:49:31 -07:00
2026-06-27 12:09:01 +00:00
2026-05-26 15:49:31 -07:00
2026-06-08 19:11:00 +00:00
2026-05-27 16:23:44 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-06-10 17:34:10 +00:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-29 01:12:11 +00:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-06-09 06:12:09 +00:00
2026-06-14 17:23:48 +02:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-06-17 06:39:22 +00:00
2026-06-26 18:35:13 +00:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-29 01:12:11 +00:00
2026-05-26 15:49:31 -07:00
2026-05-28 17:53:38 +00:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-07-10 19:07:04 +02:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-06-17 06:39:22 +00:00
2026-06-03 16:21:48 -07:00
2026-05-26 15:49:31 -07:00
2026-06-24 05:38:02 +00:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-07-02 10:07:29 +00:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-07-09 22:18:07 +00:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-06-09 06:12:09 +00:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-06-14 19:07:25 +00:00
2026-05-26 15:49:31 -07:00
2026-06-14 20:05:18 +02:00
2026-05-26 15:49:31 -07:00
2026-06-17 16:06:51 +00:00
2026-06-17 06:39:22 +00:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-06-08 16:58:42 +08:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-07-10 07:40:02 +00:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-07-03 20:34:37 +02:00
2026-05-26 15:49:31 -07:00
2026-07-01 13:18:37 +02:00
2023-06-29 23:22:55 +00:00
2026-07-08 12:10:26 +08:00
2026-05-26 15:49:31 -07:00
2026-06-29 15:10:47 +00:00
2026-06-24 05:38:02 +00:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-06-18 12:02:11 +00:00
2026-05-26 15:49:31 -07:00
2026-05-29 01:12:11 +00:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-06-17 06:50:25 +02:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-06-08 18:18:58 +00:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-07-10 19:07:04 +02:00
2026-06-13 12:02:02 +08:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-06-18 12:02:11 +00:00
2026-05-26 15:49:31 -07:00
2026-06-03 16:21:48 -07:00
2026-06-18 12:24:37 +00:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-06-12 08:36:05 +08:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-06-28 08:06:33 +00:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2022-09-02 15:18:23 -04:00
2026-05-26 15:49:31 -07:00
2026-07-07 07:07:30 +00:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-06-15 17:55:31 +00:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-07-04 17:45:11 +02:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-06-08 17:16:22 +00:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-06-17 16:06:51 +00:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-27 16:23:44 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-06-18 12:02:11 +00:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-06-06 11:06:08 +00:00
2026-06-11 17:12:30 +00:00