github-forks
/
gitea
mirror of https://github.com/go-gitea/gitea.git
1
0
Fork 0
Code Projects Releases Activity
18,972 Commits
17 Branches
224 Tags
828 MiB
Commit Graph

11 Commits (b7614e2d2f2af246e33b8bd6a38ecfd1babc9ecc)

Author SHA1 Message Date
Jason Song 125679f2e1
Support allowed hosts for migrations to work with proxy ()
Jason Song 4e98224a45
Support allowed hosts for webhook to work with proxy () 
When `webhook.PROXY_URL` has been set, the old code will check if the
proxy host is in `ALLOWED_HOST_LIST` or reject requests through the
proxy. It requires users to add the proxy host to `ALLOWED_HOST_LIST`.
However, it actually allows all requests to any port on the host, when
the proxy host is probably an internal address.

But things may be even worse. `ALLOWED_HOST_LIST` doesn't really work
when requests are sent to the allowed proxy, and the proxy could forward
them to any hosts.

This PR fixes it by:

- If the proxy has been set, always allow connectioins to the host and
port.
- Check `ALLOWED_HOST_LIST` before forwarding.
flynnnnnnnnnn e81ccc406b
Implement FSFE REUSE for golang files () 
Change all license headers to comply with REUSE specification.

Fix 

Co-authored-by: flynnnnnnnnnn <flynnnnnnnnnn@github>
Co-authored-by: John Olheiser <john.olheiser@gmail.com>
delvh 0ebb45cfe7
Replace all instances of fmt.Errorf(%v) with fmt.Errorf(%w) () 
Found using
`find . -type f -name '*.go' -print -exec vim {} -c
':%s/fmt\.Errorf(\(.*\)%v\(.*\)err/fmt.Errorf(\1%w\2err/g' -c ':wq' \;`

Co-authored-by: 6543 <6543@obermui.de>
Co-authored-by: Andrew Thornton <art27@cantab.net>
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
Lunny Xiao a4e91c4197
Add proxy host into allow list () 
Co-authored-by: techknowlogick <techknowlogick@gitea.io>
wxiaoguang f67a1030b3
Add tests for the host checking logic, clarify the behaviors () 
Before, the combination of AllowedDomains/BlockedDomains/AllowLocalNetworks is confusing.

This PR adds tests for the logic, clarify the behaviors.
wxiaoguang a51efb4c2c
Support `hostname:port` to pass host matcher's check () 
hostmatcher: split the hostname from the `hostname:port` string, use the correct hostname to do the match.
6543 60fbaa9068
remove not needed ()
Gusted ff2fd08228
Simplify parameter types () 
Remove repeated type declarations in function definitions.
wxiaoguang 013fb73068
Use `hostmatcher` to replace `matchlist`, improve security () 
Use hostmacher to replace matchlist.

And we introduce a better DialContext to do a full host/IP check, otherwise the attackers can still bypass the allow/block list by a 302 redirection.
wxiaoguang 599ff1c054
Only allow webhook to send requests to allowed hosts ()