Skip to content

[Security] Stored XSS. Account Takeover possilble. #4703

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Closed
1 of 7 tasks
ghost opened this issue Aug 14, 2018 · 3 comments · Fixed by #4710
Closed
1 of 7 tasks

[Security] Stored XSS. Account Takeover possilble. #4703

ghost opened this issue Aug 14, 2018 · 3 comments · Fixed by #4710
Labels
topic/security Something leaks user information or is otherwise vulnerable. Should be fixed!
Milestone
1.5.1

Comments

@ghost
Copy link

ghost commented Aug 14, 2018 •
edited by ghost
Loading

  • Gitea version (or commit ref): any version with external issue tracker
  • Git version: not relevant
  • Operating system: not relevant
  • Database (use [x]):
    • PostgreSQL
    • MySQL
    • MSSQL
    • SQLite
  • Can you reproduce the bug at https://try.gitea.io:
    • Yes (provide example URL)
    • No
    • Not relevant
  • Log gist:

Description

Screenshots
@techknowlogick techknowlogick added the topic/security Something leaks user information or is otherwise vulnerable. Should be fixed! label Aug 14, 2018
@techknowlogick
Copy link
Member

Thoughts from top of my head, we could use net/url and validate that external issue tracker is a valid URL and the protocol of URL is http/https.

May have time in several hours to look into where to add this into code.

Thanks for report 😄

@SagePtr SagePtr mentioned this issue Aug 14, 2018
Merged
@lafriks lafriks mentioned this issue Aug 14, 2018
Merged
@lafriks lafriks added this to the 1.5.1 milestone Aug 14, 2018
@lafriks
Copy link
Member

lafriks commented Aug 15, 2018

@cezar97 thanks for report ;)

@lafriks
Copy link
Member

lafriks commented Aug 19, 2018

I don't think that's worth the work as chances of that are quite minimal and I would not like to automatically remove or mess up someone's setttings

@beeonthego beeonthego mentioned this issue Aug 26, 2018
Closed
@go-gitea go-gitea locked and limited conversation to collaborators Nov 24, 2020
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Assignees
No one assigned
Labels
topic/security Something leaks user information or is otherwise vulnerable. Should be fixed!
Projects
None yet
Milestone
1.5.1
Development

Successfully merging a pull request may close this issue.

Improve URL validation for external wiki and external issues lafriks-fork/gitea
2 participants
@techknowlogick @lafriks