mirror of
https://github.com/go-gitea/gitea.git
synced 2026-06-28 18:56:23 +02:00
d5e6f273f0
## Problem The repository restorer (`services/migrations/restore.go`) builds `file://` URLs for release attachments and PR patches by joining user-supplied paths from `release.yml` and `pull_request.yml` onto the dump directory: ```go *asset.DownloadURL = "file://" + filepath.Join(r.baseDir, *asset.DownloadURL) pr.PatchURL = "file://" + filepath.Join(r.baseDir, pr.PatchURL) ``` `filepath.Join` cleans the path, so a crafted relative value such as `../../../../etc/passwd` resolves to an absolute path **outside** the dump directory. `uri.Open` then reads it via `os.Open` and stores the content as a release attachment, which is retrievable through the API — an arbitrary file read (Local File Inclusion) from a dump archive supplied to `restore-repo`. ## Fix Add a `localFileURL` helper that resolves the relative path against `baseDir` and rejects anything that escapes it. Malicious entries are skipped with a warning so a legitimate restore still completes; in-dump files keep working unchanged. --------- Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>