From 480efbdb96e4092493ec1e3683b2ab688ac95096 Mon Sep 17 00:00:00 2001 From: 6543 <6543@obermui.de> Date: Wed, 11 Nov 2020 22:48:08 +0100 Subject: [PATCH] Disallow urlencoded new lines in git protocol paths if there is a port (#13521) (#13525) Signed-off-by: Andrew Thornton Co-authored-by: zeripath --- modules/auth/repo_form.go | 3 +++ 1 file changed, 3 insertions(+) diff --git a/modules/auth/repo_form.go b/modules/auth/repo_form.go index 6c3421e4f7..c51adadba1 100644 --- a/modules/auth/repo_form.go +++ b/modules/auth/repo_form.go @@ -97,6 +97,9 @@ func (f MigrateRepoForm) ParseRemoteAddr(user *models.User) (string, error) { u.User = url.UserPassword(f.AuthUsername, f.AuthPassword) } remoteAddr = u.String() + if u.Scheme == "git" && u.Port() != "" && (strings.Contains(remoteAddr, "%0d") || strings.Contains(remoteAddr, "%0a")) { + return "", models.ErrInvalidCloneAddr{IsURLError: true} + } } else if !user.CanImportLocal() { return "", models.ErrInvalidCloneAddr{IsPermissionDenied: true} } else if !com.IsDir(remoteAddr) {