ynkmr/gitea
1
0
Fork 0
mirror of https://github.com/go-gitea/gitea.git synced 2026-09-08 22:13:26 +09:00
Code Issues Projects Releases Wiki Activity

fix(security): harden access checks and migration validation (#38324)

Browse Source 
Harden access checks for issue dependencies, team repository membership,
notifications, stars, tracked times and repository migrations.
This commit is contained in:
bircni
2026-07-10 19:30:43 +02:00
committed by GitHub
parent f452c369ac
commit aab3242f7b
15 changed files with 304 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files
services/migrations/migrate.go
+7 -7
View File
@@ -87,15 +87,14 @@ func IsMigrateURLAllowed(remoteURL string, doer *user_model.User) error {
}
func checkByAllowBlockList(hostName string, addrList []net.IP) error {
var ipAllowed bool
ipAllowed := len(addrList) > 0
var ipBlocked bool
for _, addr := range addrList {
ipAllowed = ipAllowed || allowList.MatchIPAddr(addr)
ipAllowed = ipAllowed && allowList.MatchIPAddr(addr)
ipBlocked = ipBlocked || blockList.MatchIPAddr(addr)
}
var blockedError error
if blockList.MatchHostName(hostName) || ipBlocked {
blockedError = &git.ErrInvalidCloneAddr{Host: hostName, IsPermissionDenied: true}
return &git.ErrInvalidCloneAddr{Host: hostName, IsPermissionDenied: true}
}
// if we have an allow-list, check the allow-list before return to get the more accurate error
if !allowList.IsEmpty() {
@@ -104,7 +103,7 @@ func checkByAllowBlockList(hostName string, addrList []net.IP) error {
}
}
// otherwise, we always follow the blocked list
return blockedError
return nil
}
// MigrateRepository migrate repository according MigrateOptions
@@ -524,9 +523,10 @@ func Init() error {
if setting.Migrations.AllowLocalNetworks {
allowList.AppendBuiltin(hostmatcher.MatchBuiltinPrivate)
allowList.AppendBuiltin(hostmatcher.MatchBuiltinLoopback)
} else {
blockList.AppendBuiltin(hostmatcher.MatchBuiltinPrivate)
blockList.AppendBuiltin(hostmatcher.MatchBuiltinLoopback)
}
// TODO: at the moment, if ALLOW_LOCALNETWORKS=false, ALLOWED_DOMAINS=domain.com, and domain.com has IP 127.0.0.1, then it's still allowed.
// if we want to block such case, the private&loopback should be added to the blockList when ALLOW_LOCALNETWORKS=false
return nil
}