summaryrefslogtreecommitdiffstats
path: root/modules
diff options
context:
space:
mode:
author6543 <6543@obermui.de>2020-11-11 22:47:42 +0100
committerGitHub <noreply@github.com>2020-11-11 23:47:42 +0200
commit122f8f86d5f6712a3b9be162aa01cb525ba4055a (patch)
tree6582526357d17aecbe267d942625a7b70cb3b678 /modules
parent1f726568925e1b410773982f9b2500bd8fc93400 (diff)
downloadgitea-122f8f86d5f6712a3b9be162aa01cb525ba4055a.tar.gz
gitea-122f8f86d5f6712a3b9be162aa01cb525ba4055a.zip
Disallow urlencoded new lines in git protocol paths if there is a port (#13521) (#13524)
Signed-off-by: Andrew Thornton <art27@cantab.net> Co-authored-by: zeripath <art27@cantab.net>
Diffstat (limited to 'modules')
-rw-r--r--modules/auth/repo_form.go3
1 files changed, 3 insertions, 0 deletions
diff --git a/modules/auth/repo_form.go b/modules/auth/repo_form.go
index 039b0cb583..f27812bb1b 100644
--- a/modules/auth/repo_form.go
+++ b/modules/auth/repo_form.go
@@ -102,6 +102,9 @@ func ParseRemoteAddr(remoteAddr, authUsername, authPassword string, user *models
u.User = url.UserPassword(authUsername, authPassword)
}
remoteAddr = u.String()
+ if u.Scheme == "git" && u.Port() != "" && (strings.Contains(remoteAddr, "%0d") || strings.Contains(remoteAddr, "%0a")) {
+ return "", models.ErrInvalidCloneAddr{IsURLError: true}
+ }
} else if !user.CanImportLocal() {
return "", models.ErrInvalidCloneAddr{IsPermissionDenied: true}
} else if !com.IsDir(remoteAddr) {