Nulo/gitea
Archived
1
0
Fork 0
Code Issues Pull requests Projects Releases Activity
This repository has been archived on 2023-02-01. You can view files and clone it, but cannot push or open issues or pull requests.
gitea/modules
History
zeripath e3d8e92bdc
Prevent redirect to Host (2) (#19175) (#19186) 
Backport #19175

Unhelpfully Locations starting with `/\` will be converted by the
browser to `//` because ... well I do not fully understand. Certainly
the RFCs and MDN do not indicate that this would be expected. Providing
"compatibility" with the (mis)behaviour of a certain proprietary OS is
my suspicion. However, we clearly have to protect against this.

Therefore we should reject redirection locations that match the regular
expression: `^/[\\\\/]+`

Reference #9678

Signed-off-by: Andrew Thornton <art27@cantab.net>
2022-03-23 20:01:23 +00:00
..
activitypub Create pub/priv keypair for federation (#17071) 2021-09-28 15:19:22 -04:00
analyze Use git attributes to determine generated and vendored status for language stats and diffs (#16773) 2021-09-09 21:13:36 +01:00
appstate Decouple unit test code from business code (#17623) 2021-11-12 22:36:47 +08:00
auth fix pam authorization (#19040) (#19047) 2022-03-10 08:15:35 +00:00
avatar Fix various typos (#18219) 2022-01-10 17:32:37 +08:00
base Simplify parameter types (#18006) 2021-12-20 04:41:31 +00:00
cache Test cache during init (#17852) 2021-12-06 00:24:57 +08:00
charset Don't treat BOM escape sequence as hidden character. (#18909) (#18910) 2022-02-26 23:15:04 +01:00
context Prevent redirect to Host (2) (#19175) (#19186) 2022-03-23 20:01:23 +00:00
convert Add MirrorUpdated field to Repository API type (#18267) 2022-01-18 13:18:30 +00:00
csv Fix various typos (#18219) 2022-01-10 17:32:37 +08:00
doctor Fix various typos (#18219) 2022-01-10 17:32:37 +08:00
emoji Run processors on whole of text (#16155) 2021-06-17 11:35:05 +01:00
eventsource Simplify parameter types (#18006) 2021-12-20 04:41:31 +00:00
generate Support webauthn (#17957) 2022-01-14 16:03:31 +01:00
git Make migrations SKIP_TLS_VERIFY apply to git too (#19132) (#19141) 2022-03-19 16:20:26 +00:00
gitgraph Collaborator trust model should trust collaborators (#18539) (#18557) 2022-02-03 11:20:37 -05:00
graceful Immediately Hammer if second kill is sent (#18823) (#18826) 2022-02-20 01:37:52 +08:00
hcaptcha hCaptcha Support (#12594) 2020-10-02 23:37:53 -04:00
highlight Bump to build with go1.18 (#19120 et al) (#19127) 2022-03-19 18:46:47 +01:00
hostmatcher Bump to build with go1.18 (#19120 et al) (#19127) 2022-03-19 18:46:47 +01:00
httpcache Use a variable but a function for IsProd because of a slight performance increment (#17368) 2021-10-20 16:37:19 +02:00
httplib refactor: move from io/ioutil to io and os package (#17109) 2021-09-22 13:38:34 +08:00
indexer Upgrade bleve from v2.0.6 to v2.3.0 (#18132) 2022-01-01 16:26:27 +08:00
json Move repository model into models/repo (#17933) 2021-12-10 09:27:50 +08:00
lfs Improve SyncMirrors logging (#19045) (#19050) 2022-03-10 16:06:35 +01:00
log Simplify parameter types (#18006) 2021-12-20 04:41:31 +00:00
markup Bump to build with go1.18 (#19120 et al) (#19127) 2022-03-19 18:46:47 +01:00
metrics Refactor auth package (#17962) 2022-01-02 21:12:35 +08:00
migration Fix various typos (#18219) 2022-01-10 17:32:37 +08:00
nosql Adjust error for already locked db and prevent level db lock on malformed connstr (#18923) (#18938) 2022-02-28 15:45:38 +00:00
notification Fix problem when self-assign notification (#18797) (#18976) 2022-03-02 20:11:55 +00:00
options Remove golang vendored directory (#18277) 2022-01-14 18:16:05 -05:00
password Fixed assert statements. (#16089) 2021-06-07 07:27:09 +02:00
pprof refactor: move from io/ioutil to io and os package (#17109) 2021-09-22 13:38:34 +08:00
private Fix the bug: deploy key with write access can not push (#19010) (#19182) 2022-03-23 13:44:41 +00:00
process Fix various typos (#18219) 2022-01-10 17:32:37 +08:00
proxy Return nil proxy function if proxy not enabled (#16742) 2021-08-19 16:41:20 -04:00
public Fix mime-type detection for HTTP server (#18371) 2022-01-23 21:17:20 +08:00
queue In disk_channel queues synchronously push to disk on shutdown (#18415) (#18788) 2022-02-22 20:08:35 +08:00
recaptcha refactor: move from io/ioutil to io and os package (#17109) 2021-09-22 13:38:34 +08:00
references Add API to get issue/pull comments and events (timeline) (#17403) 2022-01-01 22:12:25 +08:00
repository Make migrations SKIP_TLS_VERIFY apply to git too (#19132) (#19141) 2022-03-19 16:20:26 +00:00
secret Simplify parameter types (#18006) 2021-12-20 04:41:31 +00:00
session Refactor auth package (#17962) 2022-01-02 21:12:35 +08:00
setting Ensure that setting.LocalURL always has a trailing slash (#19171) (#19177) 2022-03-23 12:56:52 +08:00
ssh Update golang.org/x/crypto (#19097) (#19098) 2022-03-19 12:16:15 +00:00
storage Clean paths when looking in Storage (#19124) (#19179) 2022-03-23 09:23:00 +00:00
structs Add MirrorUpdated field to Repository API type (#18267) 2022-01-18 13:18:30 +00:00
svg refactor: move from io/ioutil to io and os package (#17109) 2021-09-22 13:38:34 +08:00
sync Fix missing unlock in uniquequeue (#9790) 2020-01-15 23:58:33 +02:00
templates Prevent start panic due to missing DotEscape function 2022-03-23 16:09:57 +00:00
test Unify and simplify TrN for i18n (#18141) 2022-01-02 04:33:57 +01:00
timeutil Don't store assets modified time into generated files (#18193) 2022-01-06 21:33:17 -05:00
translation Sort locales according to their names (#18211) 2022-01-08 12:18:39 +00:00
typesniffer Read expected buffer size (#17409) 2021-10-24 22:12:43 +01:00
updatechecker Fix various typos (#18219) 2022-01-10 17:32:37 +08:00
upload Simplify parameter types (#18006) 2021-12-20 04:41:31 +00:00
uri Prevent NPE if gitea uploader fails to open url (#18080) 2021-12-23 16:27:33 +00:00
user Add gitea-vet (#10948) 2020-04-05 07:20:50 +01:00
util Cleanup protected branches when deleting users & teams (#19158) (#19174) 2022-03-23 13:56:53 +08:00
validation Upgrade chi to v5 (#17298) 2021-10-13 22:50:23 -04:00
web Simplify parameter types (#18006) 2021-12-20 04:41:31 +00:00