Blacklist manifest.json, milestones user #4864

New Issue

GiteaMirror · 2025-11-02T06:05:18-06:00

GiteaMirror commented

2025-11-02 06:05:18 -06:00

Originally created by @SuperSandro2000 on GitHub (Feb 16, 2020).

Gitea version (or commit ref): 1.11.0
Git version: not relevant
Operating system: Docker
Database (use [x]):
- PostgreSQL
- MySQL
- MSSQL
- SQLite
Can you reproduce the bug at https://try.gitea.io:
- Yes (provide example URL): https://try.gitea.io/manifest.json
- No
- Not relevant
Log gist:

Description

The username manifest.json should be blacklisted cause the user can't access his profile. He shouldn't be able to send malicious data to users as they should not check subdirectories of a file.

The username milestones should be blacklisted cause the user can't access his profile. He shouldn't be able to abuse this as long as they milestone tab does not use any sort of subdirectory in the future.

Originally created by @SuperSandro2000 on GitHub (Feb 16, 2020). - Gitea version (or commit ref): 1.11.0 - Git version: not relevant - Operating system: Docker - Database (use `[x]`): - [x] PostgreSQL - [ ] MySQL - [ ] MSSQL - [ ] SQLite - Can you reproduce the bug at https://try.gitea.io: - [X] Yes (provide example URL): https://try.gitea.io/manifest.json - [ ] No - [ ] Not relevant - Log gist: ## Description The username ``manifest.json`` should be blacklisted cause the user can't access his profile. He shouldn't be able to send malicious data to users as they should not check subdirectories of a file. The username ``milestones`` should be blacklisted cause the user can't access his profile. He shouldn't be able to abuse this as long as they milestone tab does not use any sort of subdirectory in the future.

GiteaMirror added the type/bug label 2025-11-02 06:05:18 -06:00

GiteaMirror closed this issue

2025-11-02 06:05:18 -06:00

GiteaMirror referenced this issue

2025-11-02 13:53:00 -06:00

[PR #4864] [MERGED] Backport: Fix trimming of markup section names #17526

Sign in to join this conversation.