Passwords containing special character "/" do not work #13544

New Issue

GiteaMirror · 2025-11-02T10:45:38-06:00

GiteaMirror commented

2025-11-02 10:45:38 -06:00

Originally created by @ahorseman on GitHub (Sep 30, 2024).

Description

When using a password with a slash (potentially other special characters?) to authenticate to an existing git repository in order to clone it to Gitea, the password string gets cut at the slash and cloning / migration does not work.

Security risk: Gitea is showing the password string as plaintext in the error message (which made it though pretty obvious to me that the slash is the issue).

Gitea Version

1.21.10

Can you reproduce the bug on the Gitea demo site?

Yes

Log Gist

No response

Screenshots

No response

Git Version

No response

Operating System

No response

How are you running Gitea?

It's running via Turnkey-Linux on a Proxmox server.

Database

None

Originally created by @ahorseman on GitHub (Sep 30, 2024). ### Description When using a password with a slash (potentially other special characters?) to authenticate to an existing git repository in order to clone it to Gitea, the password string gets cut at the slash and cloning / migration does not work. Security risk: Gitea is showing the password string as plaintext in the error message (which made it though pretty obvious to me that the slash is the issue). ### Gitea Version 1.21.10 ### Can you reproduce the bug on the Gitea demo site? Yes ### Log Gist _No response_ ### Screenshots _No response_ ### Git Version _No response_ ### Operating System _No response_ ### How are you running Gitea? It's running via Turnkey-Linux on a Proxmox server. ### Database None

GiteaMirror added the issue/needs-feedback label 2025-11-02 10:45:38 -06:00

GiteaMirror closed this issue

2025-11-02 10:45:38 -06:00

GiteaMirror commented

2025-11-02 10:45:39 -06:00

@wxiaoguang commented on GitHub (Sep 30, 2024):

How to reproduce? Do you mean doing something on the Gitea's web UI, or do you mean something like git clone http://user:my/password@my-gitea.com/user/repo on your machine?

showing the password string as plaintext in the error message which error message and which page/UI? Could you use a fake password to capture a screenshot?

@wxiaoguang commented on GitHub (Sep 30, 2024): How to reproduce? Do you mean doing something on the Gitea's web UI, or do you mean something like `git clone http://user:my/password@my-gitea.com/user/repo` on your machine? `showing the password string as plaintext in the error message` which error message and which page/UI? Could you use a fake password to capture a screenshot?

GiteaMirror commented

2025-11-02 10:45:39 -06:00

@eeyrjmr commented on GitHub (Sep 30, 2024):

Is it really gitea end or git end? A backslash () will obviously cause issues in a cli git environment as this is an escape character

So depending on what was shown it was either git/bash responding locally for an ambiguous command or gitea echoing back (and yes that would be an interesting concern)

@eeyrjmr commented on GitHub (Sep 30, 2024): Is it really gitea end or git end? A backslash (\) will obviously cause issues in a cli git environment as this is an escape character So depending on what was shown it was either git/bash responding locally for an ambiguous command or gitea echoing back (and yes that would be an interesting concern)

GiteaMirror commented

2025-11-02 10:45:39 -06:00

@lafriks commented on GitHub (Oct 1, 2024):

It is because it's not a valid URL format, / must be replaced with %2F

@lafriks commented on GitHub (Oct 1, 2024): It is because it's not a valid URL format, `/` must be replaced with `%2F`

GiteaMirror commented

2025-11-02 10:45:39 -06:00

@GiteaBot commented on GitHub (Nov 1, 2024):

We close issues that need feedback from the author if there were no new comments for a month. 🍵

@GiteaBot commented on GitHub (Nov 1, 2024): We close issues that need feedback from the author if there were no new comments for a month. :tea:

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/gitea#13544