Multiple JSONs returned when doing DELETE on /v1/user/keys/2 with a non-existing key #8826

New Issue

GiteaMirror · 2025-11-02T08:20:03-06:00

GiteaMirror commented

2025-11-02 08:20:03 -06:00

Originally created by @ludovicianul on GitHub (Apr 13, 2022).

Description

While doing some fuzzing using https://github.com/Endava/cats I discovered an issue for the /v1/user/keys/ endpoint. Doing a DELETE with non existing key return 2 JSONs in the same body.

{
    "message": "",
    "url": "https://try.gitea.io/api/swagger"
}
{
    "errors": null,
    "message": "The target couldn't be found.",
    "url": "https://try.gitea.io/api/swagger"
}

You can reproduce the issue using (just replace $token with your own token):

cats replay Test243.json

Or doing a curl at https://try.gitea.io/api/v1/user/keys/2 for example.
Test243.json.zip

Gitea Version

1.17.0+dev-423-g4396d0e7c

Can you reproduce the bug on the Gitea demo site?

Yes

Log Gist

No response

Screenshots

No response

Git Version

No response

Operating System

No response

How are you running Gitea?

Using https://try.gitea.io/.

Database

No response

Originally created by @ludovicianul on GitHub (Apr 13, 2022). ### Description While doing some fuzzing using https://github.com/Endava/cats I discovered an issue for the `/v1/user/keys/` endpoint. Doing a DELETE with non existing key return 2 JSONs in the same body. ```json { "message": "", "url": "https://try.gitea.io/api/swagger" } { "errors": null, "message": "The target couldn't be found.", "url": "https://try.gitea.io/api/swagger" } ``` You can reproduce the issue using (just replace $token with your own token): `cats replay Test243.json` Or doing a curl at `https://try.gitea.io/api/v1/user/keys/2` for example. [Test243.json.zip](https://github.com/go-gitea/gitea/files/8484376/Test243.json.zip) ### Gitea Version 1.17.0+dev-423-g4396d0e7c ### Can you reproduce the bug on the Gitea demo site? Yes ### Log Gist _No response_ ### Screenshots _No response_ ### Git Version _No response_ ### Operating System _No response_ ### How are you running Gitea? Using https://try.gitea.io/. ### Database _No response_

GiteaMirror added the issue/confirmed type/bug modifies/api labels 2025-11-02 08:20:03 -06:00

GiteaMirror closed this issue

2025-11-02 08:20:04 -06:00

GiteaMirror commented

2025-11-02 08:20:05 -06:00

@wxiaoguang commented on GitHub (Apr 14, 2022):

Well, a return is lost in code again

@wxiaoguang commented on GitHub (Apr 14, 2022): Well, a `return` is lost in code again

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/gitea#8826