Mirrors/gitea
0
0
Fork 0
mirror of https://github.com/go-gitea/gitea.git synced 2026-02-22 04:35:44 +01:00
Code Issues Activity

Merge 2c742717c8616703a22041f6f9164ec10cadaad9 into bbea5e6c2d75a4a710d7838b7bec7e851e046d3c

Browse Source
This commit is contained in:
Lunny Xiao 2026-02-20 20:31:05 +00:00 committed by GitHub
commit 5f4c92cd42
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
2 changed files with 6 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
modules/httplib/url.go
View File

@ -24,6 +24,10 @@ func urlIsRelative(s string, u *url.URL) bool {
if len(s) > 1 && (s[0] == '/' || s[0] == '\\') && (s[1] == '/' || s[1] == '\\') {
return false
}
// Backslashes (including encoded) can be normalized by browsers into slashes and allow open redirects.
if strings.Contains(s, "\\") || strings.Contains(strings.ToLower(s), "%5c") {
return false
}
return u != nil && u.Scheme == "" && u.Host == ""
}

2
modules/httplib/url_test.go
View File

@ -32,6 +32,8 @@ func TestIsRelativeURL(t *testing.T) {
"\\\\",
"/\\",
"\\/",
"/a/../\\example.com",
"/a/../%5cexample.com",
"mailto:a@b.com",
"https://test.com",
}