Disallow urlencoded new lines in git protocol paths if there is a port (#13521)

Signed-off-by: Andrew Thornton <art27@cantab.net>

diff --git a/modules/auth/repo_form.go b/modules/auth/repo_form.go
index 039b0cb583a09073ba7e05ad279a89a163b91781..f27812bb1b964c5e3b8e64db7843bbaf7063df53 100644 (file)
--- a/modules/auth/repo_form.go
+++ b/modules/auth/repo_form.go
@@ -102,6 +102,9 @@ func ParseRemoteAddr(remoteAddr, authUsername, authPassword string, user *models
                        u.User = url.UserPassword(authUsername, authPassword)
                }
                remoteAddr = u.String()
+               if u.Scheme == "git" && u.Port() != "" && (strings.Contains(remoteAddr, "%0d") || strings.Contains(remoteAddr, "%0a")) {
+                       return "", models.ErrInvalidCloneAddr{IsURLError: true}
+               }
        } else if !user.CanImportLocal() {
                return "", models.ErrInvalidCloneAddr{IsPermissionDenied: true}
        } else if !com.IsDir(remoteAddr) {