mirror of
https://github.com/go-gitea/gitea.git
synced 2026-07-22 14:25:18 +02:00
f69e15afe7
Addresses a batch of privately reported security issues, grouped by area: - **SSRF** - migration PR-patch/asset fetches, OAuth2 avatar & OpenID discovery, pull-mirror URL re-validation, and the outbound proxy path. - **Access-token scope** - prevent scope escalation on token creation; keep public-only tokens confined (feeds, packages, Actions listings, star/watch lists, limited/private owners). - **Access control / disclosure** - go-get default-branch leak, webhook authorization-header leak, watch clearing on private transitions, label/attachment scoping. - **Denial of service** - input bounds for npm dist-tags, Debian control files, Arch file lists, and SSH keys. ### 📌 Attention for site admins Not breaking - existing configs keep working - but two changes are worth a look: - **New SSRF protection** Outbound requests (migrations, OAuth2 avatars, OpenID discovery, pull mirrors, proxy path) are now validated against the allow/block host lists. If your instance legitimately reaches internal hosts, you may need to add them to `[security].ALLOWED_HOST_LIST` (and the relevant `ALLOW_LOCALNETWORKS` settings). - **Deprecation** `[webhook].ALLOWED_HOST_LIST` is deprecated and will be removed in a future release. Use `[security].ALLOWED_HOST_LIST` instead; the old key still works for now. --------- Co-authored-by: TheFox0x7 <thefox0x7@gmail.com> Co-authored-by: techknowlogick <techknowlogick@gitea.io> Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com> Co-authored-by: wxiaoguang <wxiaoguang@gmail.com> Co-authored-by: Zettat123 <zettat123@gmail.com>
95 lines
3.4 KiB
Go
95 lines
3.4 KiB
Go
// Copyright 2026 The Gitea Authors. All rights reserved.
|
|
// SPDX-License-Identifier: MIT
|
|
|
|
package integration
|
|
|
|
import (
|
|
"net/http"
|
|
"testing"
|
|
|
|
auth_model "gitea.dev/models/auth"
|
|
"gitea.dev/models/unittest"
|
|
user_model "gitea.dev/models/user"
|
|
"gitea.dev/modules/setting"
|
|
"gitea.dev/modules/test"
|
|
"gitea.dev/modules/web"
|
|
"gitea.dev/routers/web/auth"
|
|
"gitea.dev/services/auth/source/oauth2"
|
|
"gitea.dev/services/context"
|
|
"gitea.dev/tests"
|
|
|
|
"github.com/markbates/goth"
|
|
"github.com/markbates/goth/gothic"
|
|
"github.com/stretchr/testify/assert"
|
|
"github.com/stretchr/testify/require"
|
|
)
|
|
|
|
func TestOAuth2AvatarFromPicture(t *testing.T) {
|
|
defer tests.PrepareTestEnv(t)()
|
|
defer test.MockVariableValue(&setting.OAuth2Client.UpdateAvatar, true)()
|
|
// the SSRF-protected avatar client blocks loopback by default; allow the loopback mock server here
|
|
defer test.MockVariableValue(&setting.Security.AllowedHostList, "loopback,external")()
|
|
|
|
mockServer := createOAuth2MockProvider()
|
|
defer mockServer.Close()
|
|
addOAuth2Source(t, "test-oidc-avatar", oauth2.Source{
|
|
Provider: "openidConnect",
|
|
ClientID: "test-client-id",
|
|
OpenIDConnectAutoDiscoveryURL: mockServer.URL + "/.well-known/openid-configuration",
|
|
})
|
|
authSource, err := auth_model.GetActiveOAuth2SourceByAuthName(t.Context(), "test-oidc-avatar")
|
|
require.NoError(t, err)
|
|
providerName := authSource.Cfg.(*oauth2.Source).Provider
|
|
|
|
t.Run("AutoRegister", func(t *testing.T) {
|
|
defer test.MockVariableValue(&setting.OAuth2Client.Username, "")()
|
|
defer test.MockVariableValue(&setting.OAuth2Client.EnableAutoRegistration, true)()
|
|
defer test.MockVariableValue(&gothic.CompleteUserAuth, func(res http.ResponseWriter, req *http.Request) (goth.User, error) {
|
|
return goth.User{
|
|
Provider: providerName,
|
|
UserID: "oidc-user-ua-pic",
|
|
Email: "oidc-user-ua-pic@example.com",
|
|
Name: "OIDC UA Pic",
|
|
AvatarURL: mockServer.URL + "/avatar.png",
|
|
}, nil
|
|
})()
|
|
|
|
req := NewRequest(t, "GET", "/user/oauth2/test-oidc-avatar/callback?code=XYZ&state=XYZ")
|
|
emptyTestSession(t).MakeRequest(t, req, http.StatusSeeOther)
|
|
|
|
user := unittest.AssertExistsAndLoadBean(t, &user_model.User{LoginName: "oidc-user-ua-pic"})
|
|
assert.True(t, user.UseCustomAvatar, "avatar must sync (requires Gitea UA)")
|
|
assert.NotEmpty(t, user.Avatar)
|
|
})
|
|
|
|
t.Run("LinkAccountRegister", func(t *testing.T) {
|
|
const newUserName = "oidc-link-register"
|
|
defer web.RouteMockReset()
|
|
web.RouteMock(web.MockAfterMiddlewares, func(ctx *context.Context) {
|
|
require.NoError(t, auth.Oauth2SetLinkAccountData(ctx, auth.LinkAccountData{
|
|
AuthSourceID: authSource.ID,
|
|
GothUser: goth.User{
|
|
Provider: providerName,
|
|
UserID: "oidc-link-register-sub",
|
|
Email: "oidc-link-register-a@example.com",
|
|
Name: "OIDC Link Register",
|
|
AvatarURL: mockServer.URL + "/avatar.png",
|
|
},
|
|
}))
|
|
})
|
|
|
|
req := NewRequestWithValues(t, "POST", "/user/link_account_signup", map[string]string{
|
|
"user_name": newUserName,
|
|
"email": "oidc-link-register-b@example.com",
|
|
"password": "AVeryStrongPassword!1",
|
|
"retype": "AVeryStrongPassword!1",
|
|
})
|
|
emptyTestSession(t).MakeRequest(t, req, http.StatusSeeOther)
|
|
|
|
user := unittest.AssertExistsAndLoadBean(t, &user_model.User{LowerName: newUserName})
|
|
require.Equal(t, auth_model.OAuth2, user.LoginType)
|
|
assert.True(t, user.UseCustomAvatar, "register-link flow must sync avatar from `picture` claim")
|
|
assert.NotEmpty(t, user.Avatar)
|
|
})
|
|
}
|