fix: various security fixes (#38406)

Addresses a batch of privately reported security issues, grouped by
area:

- **SSRF** - migration PR-patch/asset fetches, OAuth2 avatar & OpenID
discovery, pull-mirror URL re-validation, and the outbound proxy path.
- **Access-token scope** - prevent scope escalation on token creation;
keep public-only tokens confined (feeds, packages, Actions listings,
star/watch lists, limited/private owners).
- **Access control / disclosure** - go-get default-branch leak, webhook
authorization-header leak, watch clearing on private transitions,
label/attachment scoping.
- **Denial of service** - input bounds for npm dist-tags, Debian control
files, Arch file lists, and SSH keys.

### 📌 Attention for site admins

Not breaking - existing configs keep working - but two changes are worth
a look:

- **New SSRF protection** Outbound requests (migrations, OAuth2 avatars,
OpenID discovery, pull mirrors, proxy path) are now validated against
the allow/block host lists. If your instance legitimately reaches
internal hosts, you may need to add them to
`[security].ALLOWED_HOST_LIST` (and the relevant `ALLOW_LOCALNETWORKS`
settings).
- **Deprecation** `[webhook].ALLOWED_HOST_LIST` is deprecated and will
be removed in a future release. Use `[security].ALLOWED_HOST_LIST`
instead; the old key still works for now.

---------

Co-authored-by: TheFox0x7 <thefox0x7@gmail.com>
Co-authored-by: techknowlogick <techknowlogick@gitea.io>
Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
Co-authored-by: Zettat123 <zettat123@gmail.com>

services/migrations/dump.go

@@ -8,7 +8,6 @@ import (
 	"errors"
 	"fmt"
 	"io"
-	"net/http"
 	"net/url"
 	"os"
 	"path/filepath"
@@ -310,7 +309,9 @@ func (g *RepositoryDumper) CreateReleases(_ context.Context, releases ...*base.R
 						}
 						defer rc.Close()
 					} else {
-						resp, err := http.Get(*asset.DownloadURL)
+						// use the migration client so the fetch (including any redirect) is
+						// validated against the migration host allow/block list
+						resp, err := getMigrationHTTPClient().Get(*asset.DownloadURL)
 						if err != nil {
 							return err
 						}
@@ -450,8 +451,10 @@ func (g *RepositoryDumper) handlePullRequest(ctx context.Context, pr *base.PullR
 		}
 
 		// SECURITY: We will assume that the pr.PatchURL has been checked
-		// pr.PatchURL maybe a local file - but note EnsureSafe should be asserting that this safe
-		resp, err := http.Get(u) // TODO: This probably needs to use the downloader as there may be rate limiting issues here
+		// pr.PatchURL maybe a local file - but note EnsureSafe should be asserting that this safe.
+		// Use the migration client so an http(s) PatchURL (and any redirect it follows) is
+		// validated against the migration host allow/block list at dial time.
+		resp, err := getMigrationHTTPClient().Get(u)
 		if err != nil {
 			return err
 		}

services/migrations/gitea_downloader.go

@@ -84,7 +84,7 @@ func NewGiteaDownloader(ctx context.Context, baseURL, repoPath, username, passwo
 		baseURL,
 		gitea_sdk.SetToken(token),
 		gitea_sdk.SetBasicAuth(username, password),
-		gitea_sdk.SetHTTPClient(NewMigrationHTTPClient()),
+		gitea_sdk.SetHTTPClient(newMigrationHTTPClient()),
 	)
 	if err != nil {
 		log.Error(fmt.Sprintf("Failed to create NewGiteaDownloader for: %s. Error: %v", baseURL, err))
@@ -273,7 +273,7 @@ func (g *GiteaDownloader) convertGiteaRelease(rel *gitea_sdk.Release) *base.Rele
 		Created:         rel.CreatedAt,
 	}
 
-	httpClient := NewMigrationHTTPClient()
+	httpClient := newMigrationHTTPClient()
 
 	for _, asset := range rel.Attachments {
 		assetID := asset.ID // Don't optimize this, for closure we need a local variable

services/migrations/gitea_uploader.go

@@ -340,7 +340,9 @@ func (g *GiteaLocalUploader) CreateReleases(ctx context.Context, releases ...*ba
 						return err
 					}
 				} else if asset.DownloadURL != nil {
-					rc, err = uri.Open(*asset.DownloadURL)
+					// use the migration client so the fetch (including any redirect) is
+					// validated against the migration host allow/block list
+					rc, err = uri.OpenWithClient(*asset.DownloadURL, getMigrationHTTPClient())
 					if err != nil {
 						return err
 					}
@@ -585,8 +587,10 @@ func (g *GiteaLocalUploader) updateGitForPullRequest(ctx context.Context, pr *ba
 		}
 
 		// SECURITY: We will assume that the pr.PatchURL has been checked
-		// pr.PatchURL maybe a local file - but note EnsureSafe should be asserting that this safe
-		ret, err := uri.Open(pr.PatchURL) // TODO: This probably needs to use the downloader as there may be rate limiting issues here
+		// pr.PatchURL maybe a local file - but note EnsureSafe should be asserting that this safe.
+		// Use the migration client so an http(s) PatchURL (and any redirect it follows) is
+		// validated against the migration host allow/block list at dial time.
+		ret, err := uri.OpenWithClient(pr.PatchURL, getMigrationHTTPClient())
 		if err != nil {
 			return err
 		}

services/migrations/github.go

@@ -329,7 +329,7 @@ func (g *GithubDownloaderV3) convertGithubRelease(ctx context.Context, rel *gith
 		r.Published = rel.PublishedAt.Time
 	}
 
-	httpClient := NewMigrationHTTPClient()
+	httpClient := newMigrationHTTPClient()
 
 	for _, asset := range rel.Assets {
 		assetID := asset.GetID() // Don't optimize this, for closure we need a local variable TODO: no need to do so in new Golang

services/migrations/gitlab.go

@@ -94,7 +94,7 @@ type GitlabDownloader struct {
 //	Use either a username/password, personal token entered into the username field, or anonymous/public access
 //	Note: Public access only allows very basic access
 func NewGitlabDownloader(ctx context.Context, baseURL, repoPath, token string) (*GitlabDownloader, error) {
-	gitlabClient, err := gitlab.NewClient(token, gitlab.WithBaseURL(baseURL), gitlab.WithHTTPClient(NewMigrationHTTPClient()))
+	gitlabClient, err := gitlab.NewClient(token, gitlab.WithBaseURL(baseURL), gitlab.WithHTTPClient(newMigrationHTTPClient()))
 	if err != nil {
 		log.Trace("Error logging into gitlab: %v", err)
 		return nil, err
@@ -314,7 +314,7 @@ func (g *GitlabDownloader) convertGitlabRelease(ctx context.Context, rel *gitlab
 		PublisherName:   rel.Author.Username,
 	}
 
-	httpClient := NewMigrationHTTPClient()
+	httpClient := newMigrationHTTPClient()
 
 	for _, asset := range rel.Assets.Links {
 		assetID := asset.ID // Don't optimize this, for closure we need a local variable

services/migrations/http_client.go

@@ -10,20 +10,33 @@ import (
 	"gitea.dev/modules/hostmatcher"
 	"gitea.dev/modules/proxy"
 	"gitea.dev/modules/setting"
+	"gitea.dev/modules/util"
 )
 
-// NewMigrationHTTPClient returns a HTTP client for migration
-func NewMigrationHTTPClient() *http.Client {
+// migrationHTTPClient is the shared migration client. Callers that would otherwise build a client per
+// request use it (via getMigrationHTTPClient) so a single connection pool is reused across downloads —
+// e.g. many release assets from the same host — instead of a fresh pool and TLS handshake each time. It
+// is built lazily on first use and reset by Init whenever the allow/block lists change; OnceValue keeps
+// concurrent callers sharing a single client instead of racing to create their own.
+var migrationHTTPClient = util.OnceValue[*http.Client]{Func: newMigrationHTTPClient}
+
+// newMigrationHTTPClient returns a HTTP client for migration
+func newMigrationHTTPClient() *http.Client {
 	return &http.Client{
 		Transport: NewMigrationHTTPTransport(),
 	}
 }
 
-// NewMigrationHTTPTransport returns a HTTP transport for migration
+// getMigrationHTTPClient returns the shared migration client, building it on first use so no request
+// escapes the SSRF-validated transport even before Init has run.
+func getMigrationHTTPClient() *http.Client {
+	return migrationHTTPClient.Value()
+}
+
+// NewMigrationHTTPTransport returns a HTTP transport for migration. The target is validated against the
+// allow/block lists on both the direct-dial and proxy paths, so a configured proxy cannot be used to
+// reach an otherwise-forbidden target (SSRF).
 func NewMigrationHTTPTransport() *http.Transport {
-	return &http.Transport{
-		TLSClientConfig: &tls.Config{InsecureSkipVerify: setting.Migrations.SkipTLSVerify},
-		Proxy:           proxy.Proxy(),
-		DialContext:     hostmatcher.NewDialContext("migration", allowList, blockList, setting.Proxy.ProxyURLFixed),
-	}
+	return hostmatcher.NewHTTPTransport("migration", allowList, blockList, proxy.Proxy(), setting.Proxy.ProxyURLFixed,
+		&tls.Config{InsecureSkipVerify: setting.Migrations.SkipTLSVerify})
 }

services/migrations/migrate.go

@@ -528,5 +528,9 @@ func Init() error {
 		blockList.AppendBuiltin(hostmatcher.MatchBuiltinLoopback)
 	}
 
+	// reset the shared client so it is rebuilt from the freshly parsed lists on next use; download paths
+	// then reuse one connection pool instead of creating a client (and pool) per request
+	migrationHTTPClient.Reset()
+
 	return nil
 }