[PR #3082] [MERGED] Fix error message sanitiziation #16755

New Issue

GiteaMirror · 2025-11-02T12:18:21-06:00

GiteaMirror commented

2025-11-02 12:18:21 -06:00

📋 Pull Request Information

Original PR: https://github.com/go-gitea/gitea/pull/3082
Author: @ethantkoenig
Created: 12/3/2017
Status: ✅ Merged
Merged: 12/4/2017
Merged by: @lafriks

Base: master ← Head: improve/mirror

📝 Commits (2)

4f0c5ea Fix error message sanitiziation
0c10249 Merge branch 'master' into improve/mirror

📊 Changes

4 files changed (+64 additions, -31 deletions)

View changed files

📝 models/repo_mirror.go (+7 -26)
➕ modules/util/sanitize.go (+48 -0)
📝 routers/api/v1/repo/repo.go (+3 -3)
📝 routers/repo/repo.go (+6 -2)

📄 Description

Fixes two sanitization issues:

Previous usage of the HandleCloneUserCredentials function did not cover the case where a message contained a sensitive URLs multiple times; only the first usage would be sanitized.
In the MigratePost handler, an unsanitized error could reach the handleCreateError(..) function, which itself does not do any sanitization. As a result, unsanitized URL could be printed in logs.

This PR additionally:

moves shared URL-sanitization code to modules/util
does some refactoring to use net/url instead of manually parsing urls (https://github.com/go-gitea/gitea/pull/3078#discussion_r154536291)

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/go-gitea/gitea/pull/3082 **Author:** [@ethantkoenig](https://github.com/ethantkoenig) **Created:** 12/3/2017 **Status:** ✅ Merged **Merged:** 12/4/2017 **Merged by:** [@lafriks](https://github.com/lafriks) **Base:** `master` ← **Head:** `improve/mirror` --- ### 📝 Commits (2) - [`4f0c5ea`](https://github.com/go-gitea/gitea/commit/4f0c5ea6a877377b3a40bd6c87c27967e01d2aa5) Fix error message sanitiziation - [`0c10249`](https://github.com/go-gitea/gitea/commit/0c102491d4e3f8ae49d34be530026e94f9ff3803) Merge branch 'master' into improve/mirror ### 📊 Changes **4 files changed** (+64 additions, -31 deletions) <details> <summary>View changed files</summary> 📝 `models/repo_mirror.go` (+7 -26) ➕ `modules/util/sanitize.go` (+48 -0) 📝 `routers/api/v1/repo/repo.go` (+3 -3) 📝 `routers/repo/repo.go` (+6 -2) </details> ### 📄 Description Fixes two sanitization issues: 1. Previous usage of the `HandleCloneUserCredentials` function did not cover the case where a message contained a sensitive URLs multiple times; only the first usage would be sanitized. 2. In the `MigratePost` handler, an unsanitized error could reach the `handleCreateError(..)` function, which itself does not do any sanitization. As a result, unsanitized URL could be printed in logs. This PR additionally: - moves shared URL-sanitization code to `modules/util` - does some refactoring to use `net/url` instead of manually parsing urls (https://github.com/go-gitea/gitea/pull/3078#discussion_r154536291) --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

GiteaMirror added the pull-request label 2025-11-02 12:18:21 -06:00

GiteaMirror closed this issue

2025-11-02 12:18:21 -06:00

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/gitea#16755