fix: various security fixes (#38406)

Addresses a batch of privately reported security issues, grouped by
area:

- **SSRF** - migration PR-patch/asset fetches, OAuth2 avatar & OpenID
discovery, pull-mirror URL re-validation, and the outbound proxy path.
- **Access-token scope** - prevent scope escalation on token creation;
keep public-only tokens confined (feeds, packages, Actions listings,
star/watch lists, limited/private owners).
- **Access control / disclosure** - go-get default-branch leak, webhook
authorization-header leak, watch clearing on private transitions,
label/attachment scoping.
- **Denial of service** - input bounds for npm dist-tags, Debian control
files, Arch file lists, and SSH keys.

### 📌 Attention for site admins

Not breaking - existing configs keep working - but two changes are worth
a look:

- **New SSRF protection** Outbound requests (migrations, OAuth2 avatars,
OpenID discovery, pull mirrors, proxy path) are now validated against
the allow/block host lists. If your instance legitimately reaches
internal hosts, you may need to add them to
`[security].ALLOWED_HOST_LIST` (and the relevant `ALLOW_LOCALNETWORKS`
settings).
- **Deprecation** `[webhook].ALLOWED_HOST_LIST` is deprecated and will
be removed in a future release. Use `[security].ALLOWED_HOST_LIST`
instead; the old key still works for now.

---------

Co-authored-by: TheFox0x7 <thefox0x7@gmail.com>
Co-authored-by: techknowlogick <techknowlogick@gitea.io>
Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
Co-authored-by: Zettat123 <zettat123@gmail.com>

tests/integration/goget_test.go

@@ -8,11 +8,15 @@ import (
 	"net/http"
 	"testing"
 
+	auth_model "gitea.dev/models/auth"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unittest"
 	"gitea.dev/modules/setting"
 	"gitea.dev/modules/test"
 	"gitea.dev/tests"
 
 	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
 )
 
 func TestGoGet(t *testing.T) {
@@ -55,3 +59,83 @@ func TestGoGetForSSH(t *testing.T) {
 
 	assert.Equal(t, expected, resp.Body.String())
 }
+
+// TestGoGetPrivateRepoBranchNotLeaked ensures the go-get meta endpoint does not disclose a
+// private repository's default branch name to unauthorized callers.
+func TestGoGetPrivateRepoBranchNotLeaked(t *testing.T) {
+	defer tests.PrepareTestEnv(t)()
+
+	// user2/repo2 is private; give it a non-default branch name
+	repo := unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: 2})
+	require.True(t, repo.IsPrivate)
+	repo.DefaultBranch = "secretbranch"
+	require.NoError(t, repo_model.UpdateRepositoryColsNoAutoTime(t.Context(), repo, "default_branch"))
+
+	// an unauthenticated caller must see the neutral instance default, not the real branch
+	req := NewRequest(t, "GET", "/user2/repo2?go-get=1")
+	resp := MakeRequest(t, req, http.StatusOK)
+	assert.Contains(t, resp.Body.String(), "/src/branch/master{/dir}")
+	assert.NotContains(t, resp.Body.String(), "secretbranch")
+
+	// the owner may still see the real default branch
+	session := loginUser(t, "user2")
+	req = NewRequest(t, "GET", "/user2/repo2?go-get=1")
+	resp = session.MakeRequest(t, req, http.StatusOK)
+	assert.Contains(t, resp.Body.String(), "secretbranch")
+}
+
+// TestGoGetPublicRepoUnderLimitedOwnerBranchNotLeaked ensures the go-get meta endpoint does not disclose
+// the default branch of a public repo whose owner is not visible to the caller (here a limited org, which
+// is hidden from anonymous callers but visible to authenticated ones).
+func TestGoGetPublicRepoUnderLimitedOwnerBranchNotLeaked(t *testing.T) {
+	defer tests.PrepareTestEnv(t)()
+
+	// repo id 38 is a public repo owned by a limited org; give it a non-default branch name
+	repo := unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: 38})
+	require.False(t, repo.IsPrivate)
+	require.NoError(t, repo.LoadOwner(t.Context()))
+	require.False(t, repo.Owner.Visibility.IsPublic())
+	repo.DefaultBranch = "secretbranch"
+	require.NoError(t, repo_model.UpdateRepositoryColsNoAutoTime(t.Context(), repo, "default_branch"))
+
+	url := fmt.Sprintf("/%s/%s?go-get=1", repo.OwnerName, repo.Name)
+
+	// an anonymous caller cannot see the limited owner, so the neutral instance default is returned
+	resp := MakeRequest(t, NewRequest(t, "GET", url), http.StatusOK)
+	assert.Contains(t, resp.Body.String(), "/src/branch/master{/dir}")
+	assert.NotContains(t, resp.Body.String(), "secretbranch")
+
+	// an authenticated caller can see a limited org's public repo, so the real branch is shown
+	session := loginUser(t, "user2")
+	resp = session.MakeRequest(t, NewRequest(t, "GET", url), http.StatusOK)
+	assert.Contains(t, resp.Body.String(), "secretbranch")
+}
+
+// TestGoGetPrivateRepoBranchNotLeakedToTokenWithoutRepoScope ensures a PAT that was not granted repository
+// read scope cannot learn a private repo's default branch through go-get, even when the account behind the
+// token could read the repository.
+func TestGoGetPrivateRepoBranchNotLeakedToTokenWithoutRepoScope(t *testing.T) {
+	defer tests.PrepareTestEnv(t)()
+
+	// user2/repo2 is private; give it a non-default branch name
+	repo := unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: 2})
+	require.True(t, repo.IsPrivate)
+	repo.DefaultBranch = "secretbranch"
+	require.NoError(t, repo_model.UpdateRepositoryColsNoAutoTime(t.Context(), repo, "default_branch"))
+
+	// a token scoped only to read:misc does not grant repository read: the branch must stay hidden.
+	// Web routes authenticate a token via basic auth (username + token), which also records the scope.
+	miscToken := getUserToken(t, "user2", auth_model.AccessTokenScopeReadMisc)
+	req := NewRequest(t, "GET", "/user2/repo2?go-get=1")
+	req.Request.SetBasicAuth("user2", miscToken)
+	resp := MakeRequest(t, req, http.StatusOK)
+	assert.Contains(t, resp.Body.String(), "/src/branch/master{/dir}")
+	assert.NotContains(t, resp.Body.String(), "secretbranch")
+
+	// a token that includes repository read scope may see the real branch
+	repoToken := getUserToken(t, "user2", auth_model.AccessTokenScopeReadRepository)
+	req = NewRequest(t, "GET", "/user2/repo2?go-get=1")
+	req.Request.SetBasicAuth("user2", repoToken)
+	resp = MakeRequest(t, req, http.StatusOK)
+	assert.Contains(t, resp.Body.String(), "secretbranch")
+}