aboutsummaryrefslogtreecommitdiffstats
path: root/modules/hostmatcher
Commit message (Collapse)AuthorAgeFilesLines
* Support allowed hosts for migrations to work with proxy (#32025)Jason Song2024-09-111-5/+1
|
* Support allowed hosts for webhook to work with proxy (#27655)Jason Song2023-10-181-3/+15
| | | | | | | | | | | | | | | | | When `webhook.PROXY_URL` has been set, the old code will check if the proxy host is in `ALLOWED_HOST_LIST` or reject requests through the proxy. It requires users to add the proxy host to `ALLOWED_HOST_LIST`. However, it actually allows all requests to any port on the host, when the proxy host is probably an internal address. But things may be even worse. `ALLOWED_HOST_LIST` doesn't really work when requests are sent to the allowed proxy, and the proxy could forward them to any hosts. This PR fixes it by: - If the proxy has been set, always allow connectioins to the host and port. - Check `ALLOWED_HOST_LIST` before forwarding.
* Implement FSFE REUSE for golang files (#21840)flynnnnnnnnnn2022-11-273-6/+3
| | | | | | | | | Change all license headers to comply with REUSE specification. Fix #16132 Co-authored-by: flynnnnnnnnnn <flynnnnnnnnnn@github> Co-authored-by: John Olheiser <john.olheiser@gmail.com>
* Replace all instances of fmt.Errorf(%v) with fmt.Errorf(%w) (#21551)delvh2022-10-241-1/+1
| | | | | | | | | Found using `find . -type f -name '*.go' -print -exec vim {} -c ':%s/fmt\.Errorf(\(.*\)%v\(.*\)err/fmt.Errorf(\1%w\2err/g' -c ':wq' \;` Co-authored-by: 6543 <6543@obermui.de> Co-authored-by: Andrew Thornton <art27@cantab.net> Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
* Add proxy host into allow list (#20798)Lunny Xiao2022-08-161-0/+5
| | | Co-authored-by: techknowlogick <techknowlogick@gitea.io>
* Add tests for the host checking logic, clarify the behaviors (#20328)wxiaoguang2022-07-131-4/+4
| | | | | | Before, the combination of AllowedDomains/BlockedDomains/AllowLocalNetworks is confusing. This PR adds tests for the logic, clarify the behaviors.
* Support `hostname:port` to pass host matcher's check #19543 (#19543)wxiaoguang2022-04-292-2/+9
| | | hostmatcher: split the hostname from the `hostname:port` string, use the correct hostname to do the match.
* remove not needed (#19128)65432022-03-181-4/+2
|
* Simplify parameter types (#18006)Gusted2021-12-202-3/+3
| | | Remove repeated type declarations in function definitions.
* Use `hostmatcher` to replace `matchlist`, improve security (#17605)wxiaoguang2021-11-203-58/+217
| | | | | Use hostmacher to replace matchlist. And we introduce a better DialContext to do a full host/IP check, otherwise the attackers can still bypass the allow/block list by a 302 redirection.
* Only allow webhook to send requests to allowed hosts (#17482)wxiaoguang2021-11-012-0/+213
generated by cgit v1.2.3 (git 2.39.1) at 2025-01-15 17:29:37 +0000