fix(httplib): prevent leaking localhost:3000 in public links (#39217)

Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>

routers/api/actions/artifacts.go

@@ -130,13 +130,18 @@ func ArtifactsRoutes(prefix string) *web.Router {
 	return m
 }
 
+func newArtifactContext(resp http.ResponseWriter, req *http.Request) *ArtifactContext {
+	base := context.NewBaseContext(resp, req)
+	ctx := &ArtifactContext{Base: base}
+	ctx.SetContextValue(artifactContextKey, ctx)
+	httplib.MarkRequestSupportPublicURL(ctx)
+	return ctx
+}
+
 func ArtifactContexter() func(next http.Handler) http.Handler {
 	return func(next http.Handler) http.Handler {
 		return http.HandlerFunc(func(resp http.ResponseWriter, req *http.Request) {
-			base := context.NewBaseContext(resp, req)
-
-			ctx := &ArtifactContext{Base: base}
-			ctx.SetContextValue(artifactContextKey, ctx)
+			ctx := newArtifactContext(resp, req)
 
 			// action task call server api with Bearer ACTIONS_RUNTIME_TOKEN
 			// we should verify the ACTIONS_RUNTIME_TOKEN

routers/api/actions/artifactsv4.go

@@ -114,7 +114,6 @@ import (
 	"gitea.dev/modules/util"
 	"gitea.dev/modules/web"
 	"gitea.dev/services/actions"
-	"gitea.dev/services/context"
 
 	"google.golang.org/protobuf/encoding/protojson"
 	"google.golang.org/protobuf/reflect/protoreflect"
@@ -132,9 +131,7 @@ type artifactV4Routes struct {
 func ArtifactV4Contexter() func(next http.Handler) http.Handler {
 	return func(next http.Handler) http.Handler {
 		return http.HandlerFunc(func(resp http.ResponseWriter, req *http.Request) {
-			base := context.NewBaseContext(resp, req)
-			ctx := &ArtifactContext{Base: base}
-			ctx.SetContextValue(artifactContextKey, ctx)
+			ctx := newArtifactContext(resp, req)
 			next.ServeHTTP(ctx.Resp, ctx.Req)
 		})
 	}