[Bug] 500 on accessing stripped-parameter URL #14286

New Issue

GiteaMirror · 2025-11-02T11:08:40-06:00

GiteaMirror commented

2025-11-02 11:08:40 -06:00

Originally created by @OdinVex on GitHub (Mar 21, 2025).

Description

Attempting to access https://demo.gitea.com/user/oauth2/Gitea.Com/callback results in a 500.

On a side note it was unintentional access, my browser extension stripped parameters.

Screenshots

500

Gitea Version

1.24.0+dev-460-gdcbf6c2d13

Can you reproduce the bug on the Gitea demo site?

Yes

Operating System

No response

Browser Version

LibreWolf

Originally created by @OdinVex on GitHub (Mar 21, 2025). ### Description Attempting to access `https://demo.gitea.com/user/oauth2/Gitea.Com/callback` results in a 500. On a side note it was unintentional access, my browser extension stripped parameters. ### Screenshots 500 ### Gitea Version 1.24.0+dev-460-gdcbf6c2d13 ### Can you reproduce the bug on the Gitea demo site? Yes ### Operating System _No response_ ### Browser Version LibreWolf

GiteaMirror added the topic/ui type/bug labels 2025-11-02 11:08:40 -06:00

GiteaMirror closed this issue

2025-11-02 11:08:40 -06:00

GiteaMirror commented

2025-11-02 11:08:41 -06:00

@wxiaoguang commented on GitHub (Mar 21, 2025):

What browser extension you are using? The proper callback URL is like this, and it is valid URL.

By the way, some bad requests indeed would cause 500 error, it is a known and trivial problem because normal users won't be affected.

@wxiaoguang commented on GitHub (Mar 21, 2025): What browser extension you are using? The proper callback URL is like this, and it is valid URL. By the way, some bad requests indeed would cause 500 error, it is a known and trivial problem because normal users won't be affected. ![Image](https://github.com/user-attachments/assets/d059327a-ca53-4aad-b222-87b7fc86fdd6)

GiteaMirror commented

2025-11-02 11:08:41 -06:00

@OdinVex commented on GitHub (Mar 21, 2025):

I know my browser extension stripped it, I mentioned that, but a 500 usually means unable to handle an exception. I use many add-ons (including a few that would strip), but in this case it was "cleaned" up by CleanLinks (modified variant of my own to deobfuscate Bing URLs in particular). I'd offer the thought of redirecting to the login page (usually suggestive of "check your extensions" when that happens), maybe with an indicative message.

@OdinVex commented on GitHub (Mar 21, 2025): I know my browser extension stripped it, I mentioned that, but a 500 usually means unable to handle an exception. I use many add-ons (including a few that would strip), but in this case it was "cleaned" up by CleanLinks (modified variant of my own to deobfuscate Bing URLs in particular). I'd offer the thought of redirecting to the login page (usually suggestive of "check your extensions" when that happens), maybe with an indicative message.

GiteaMirror commented

2025-11-02 11:08:41 -06:00

@wxiaoguang commented on GitHub (Mar 21, 2025):

By the way, some bad requests indeed would cause 500 error, it is a known and trivial problem because normal users won't be affected.

Yep, I agree that other error messages could be better. However that's a longstanding problem, a lot of old code was written that way, so it needs time and manpower to clean up them one by one ......

@wxiaoguang commented on GitHub (Mar 21, 2025): > By the way, some bad requests indeed would cause 500 error, it is a known and trivial problem because normal users won't be affected. Yep, I agree that other error messages could be better. However that's a longstanding problem, a lot of old code was written that way, so it needs time and manpower to clean up them one by one ......

GiteaMirror commented

2025-11-02 11:08:41 -06:00

@wxiaoguang commented on GitHub (Mar 21, 2025):

For this 500 error, we can do this: Improve oauth2 error handling #33969

@wxiaoguang commented on GitHub (Mar 21, 2025): For this 500 error, we can do this: Improve oauth2 error handling #33969

GiteaMirror commented

2025-11-02 11:08:42 -06:00

@OdinVex commented on GitHub (Mar 21, 2025):

Looks great. :)

@OdinVex commented on GitHub (Mar 21, 2025): Looks great. :)

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/gitea#14286