mirror of
https://github.com/go-gitea/gitea.git
synced 2026-09-04 20:13:24 +09:00
fix(httplib): prevent leaking localhost:3000 in public links (#39217)
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
This commit is contained in:
co-authored by
wxiaoguang
parent
52fcd2d2a0
commit
bcd913a4e2
@@ -87,19 +87,8 @@ func RequestContextHandler() func(h http.Handler) http.Handler {
|
||||
}
|
||||
}()
|
||||
|
||||
ds := reqctx.GetRequestDataStore(ctx)
|
||||
req = req.WithContext(cache.WithCacheContext(ctx))
|
||||
ds.SetContextValue(httplib.RequestContextKey, req)
|
||||
ds.AddCleanUp(func() {
|
||||
// TODO: GOLANG-HTTP-TMPDIR: Golang saves the uploaded files to temp directory (TMPDIR) when parsing multipart-form.
|
||||
// The "req" might have changed due to the new "req.WithContext" calls
|
||||
// For example: in NewBaseContext, a new "req" with context is created, and the multipart-form is parsed there.
|
||||
// So we always use the latest "req" from the data store.
|
||||
ctxReq := ds.GetContextValue(httplib.RequestContextKey).(*http.Request) //nolint:forcetypeassert // must be valid
|
||||
if ctxReq.MultipartForm != nil {
|
||||
_ = ctxReq.MultipartForm.RemoveAll() // remove the temp files buffered to tmp directory
|
||||
}
|
||||
})
|
||||
ctx = cache.WithCacheContext(req.Context())
|
||||
req = httplib.RequestWithContext(req, reqctx.FromContext(ctx))
|
||||
next.ServeHTTP(respWriter, req)
|
||||
})
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user