aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
author65432020-11-11 22:48:08 +0100
committerGitHub2020-11-11 23:48:08 +0200
commit480efbdb96e4092493ec1e3683b2ab688ac95096 (patch)
tree499f1827709cc95428afdac69156bf4d56040313
parent4a71d4de689d0a301786d7b20b22b151e6d3e6a3 (diff)
Disallow urlencoded new lines in git protocol paths if there is a port (#13521) (#13525)
Signed-off-by: Andrew Thornton <art27@cantab.net> Co-authored-by: zeripath <art27@cantab.net>
-rw-r--r--modules/auth/repo_form.go3
1 files changed, 3 insertions, 0 deletions
diff --git a/modules/auth/repo_form.go b/modules/auth/repo_form.go
index 6c3421e4f..c51adadba 100644
--- a/modules/auth/repo_form.go
+++ b/modules/auth/repo_form.go
@@ -97,6 +97,9 @@ func (f MigrateRepoForm) ParseRemoteAddr(user *models.User) (string, error) {
u.User = url.UserPassword(f.AuthUsername, f.AuthPassword)
}
remoteAddr = u.String()
+ if u.Scheme == "git" && u.Port() != "" && (strings.Contains(remoteAddr, "%0d") || strings.Contains(remoteAddr, "%0a")) {
+ return "", models.ErrInvalidCloneAddr{IsURLError: true}
+ }
} else if !user.CanImportLocal() {
return "", models.ErrInvalidCloneAddr{IsPermissionDenied: true}
} else if !com.IsDir(remoteAddr) {