Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Encoded path will be decoded by middleware.StripSlashes and mismatch routers #23242

Closed
wolfogre opened this issue Mar 2, 2023 · 0 comments · Fixed by #21333
Closed

Encoded path will be decoded by middleware.StripSlashes and mismatch routers #23242

wolfogre opened this issue Mar 2, 2023 · 0 comments · Fixed by #21333
Labels
type/bug

Comments

@wolfogre
Copy link
Member

wolfogre commented Mar 2, 2023 •
edited
Loading

Description

When everything is right:

  • https://gitea.com/gitea/blog -> 200
  • https://gitea.com/gitea%2Fblog -> 404

However:

  • https://gitea.com/gitea%2Fblog/ -> 200

It is caused by a bug in middleware.StripSlashes of chi, see go-chi/chi#799

We don't have to wait for it to be fixed in upstream, it can be fixed in #21333 by dropping middleware.StripSlashes.

Gitea Version

7a5af25

Can you reproduce the bug on the Gitea demo site?

Yes

Log Gist

No response

Screenshots

No response

Git Version

No response

Operating System

No response

How are you running Gitea?

command

Database

None
@wolfogre wolfogre mentioned this issue Mar 2, 2023
Merged
lunny added a commit that referenced this issue Mar 4, 2023
@sandyydk @zeripath
@wolfogre @lunny
Support sanitising the URL by removing extra slashes in the URL (#21333)
547c173 
Changes in this PR :

Strips incoming request URL of additional slashes (/). For example an
input like

`https://git.data.coop//halfd/new-website.git` is translated to
`https://git.data.coop/halfd/new-website.git`

Fixes #20462

Fix #23242

---------

Co-authored-by: zeripath <[email protected]>
Co-authored-by: Jason Song <[email protected]>
Co-authored-by: Lunny Xiao <[email protected]>
GiteaBot pushed a commit to GiteaBot/gitea that referenced this issue Mar 4, 2023
@sandyydk @zeripath
@wolfogre @lunny @GiteaBot
Support sanitising the URL by removing extra slashes in the URL (go-g…
0e4b135 
…itea#21333)

Changes in this PR :

Strips incoming request URL of additional slashes (/). For example an
input like

`https://git.data.coop//halfd/new-website.git` is translated to
`https://git.data.coop/halfd/new-website.git`

Fixes go-gitea#20462

Fix go-gitea#23242

---------

Co-authored-by: zeripath <[email protected]>
Co-authored-by: Jason Song <[email protected]>
Co-authored-by: Lunny Xiao <[email protected]>
@GiteaBot GiteaBot mentioned this issue Mar 4, 2023
Merged
techknowlogick pushed a commit that referenced this issue Mar 5, 2023
@GiteaBot @sandyydk
@zeripath @wolfogre @lunny @delvh
Support sanitising the URL by removing extra slashes in the URL (#21333…
a2a9b0f 
…) (#23300)

Backport #21333

Changes in this PR :

Strips incoming request URL of additional slashes (/). For example an
input like

`https://git.data.coop//halfd/new-website.git` is translated to
`https://git.data.coop/halfd/new-website.git`

Fixes #20462

Fix #23242

Co-authored-by: Sandeep Bhat <[email protected]>
Co-authored-by: zeripath <[email protected]>
Co-authored-by: Jason Song <[email protected]>
Co-authored-by: Lunny Xiao <[email protected]>
Co-authored-by: delvh <[email protected]>
@go-gitea go-gitea locked and limited conversation to collaborators May 3, 2023
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Assignees
No one assigned
Labels
type/bug
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

Support sanitising the URL by removing extra slashes in the URL sandyydk/gitea
1 participant
@wolfogre