mirror of
https://codeberg.org/forgejo/forgejo.git
synced 2026-07-12 20:48:40 +00:00
540551acf2
Adds an extra check to ensure the `keyId` and `actorId` included in signed requests and actor records point back to the originating host. This check prevents server-side request forgery (SSRF) attacks where a carefully crafted request could be used to trick a federation server into making requests to arbitrary hosts and ports. Further refactors can make these checks more robust, but would better fit after other existing refactor PRs are merged. Related: https://codeberg.org/forgejo/forgejo/issues/11779 ### Tests for Go changes - I added test coverage for Go changes... - [x] in their respective `*_test.go` for unit tests. - [x] in the `tests/integration` directory if it involves interactions with a live Forgejo server. - I ran... - [x] `make pr-go` before pushing ### Documentation - [ ] I created a pull request [to the documentation](https://codeberg.org/forgejo/docs) to explain to Forgejo users how to use this change. - [x] I did not document these changes and I do not expect someone else to do it. ### Release notes - [ ] This change will be noticed by a Forgejo user or admin (feature, bug fix, performance, etc.). I suggest to include a release note for this change. - [x] This change is not visible to a Forgejo user or admin (refactor, dependency upgrade, etc.). I think there is no need to add a release note for this change. Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/11795 Reviewed-by: Gusted <gusted@noreply.codeberg.org> Reviewed-by: Mathieu Fenniak <mfenniak@noreply.codeberg.org> |
||
|---|---|---|
| .. | ||
| config | ||
| actions.go | ||
| actions_test.go | ||
| admin.go | ||
| admin_test.go | ||
| api.go | ||
| asset_dynamic.go | ||
| asset_static.go | ||
| attachment.go | ||
| attachment_test.go | ||
| authorized_integration.go | ||
| badges.go | ||
| cache.go | ||
| camo.go | ||
| config.go | ||
| config_env.go | ||
| config_env_test.go | ||
| config_provider.go | ||
| config_provider_test.go | ||
| cors.go | ||
| cron.go | ||
| cron_test.go | ||
| database.go | ||
| database_sqlite.go | ||
| database_test.go | ||
| disposable_email_domain_data.go | ||
| f3.go | ||
| f3_test.go | ||
| federation.go | ||
| forgejo_storage_test.go | ||
| git.go | ||
| git_test.go | ||
| highlight.go | ||
| i18n.go | ||
| incoming_email.go | ||
| incoming_email_test.go | ||
| indexer.go | ||
| indexer_test.go | ||
| lfs.go | ||
| lfs_test.go | ||
| log.go | ||
| log_test.go | ||
| mailer.go | ||
| mailer_test.go | ||
| markup.go | ||
| metrics.go | ||
| migrations.go | ||
| mime_type_map.go | ||
| mirror.go | ||
| moderation.go | ||
| oauth2.go | ||
| oauth2_test.go | ||
| other.go | ||
| packages.go | ||
| packages_test.go | ||
| path.go | ||
| path_test.go | ||
| picture.go | ||
| project.go | ||
| proxy.go | ||
| pwa.go | ||
| queue.go | ||
| quota.go | ||
| quota_test.go | ||
| repository.go | ||
| repository_archive.go | ||
| repository_archive_test.go | ||
| repository_test.go | ||
| security.go | ||
| server.go | ||
| server_test.go | ||
| service.go | ||
| service_test.go | ||
| session.go | ||
| setting.go | ||
| setting_test.go | ||
| ssh.go | ||
| storage.go | ||
| storage_test.go | ||
| task.go | ||
| time.go | ||
| ui.go | ||
| webhook.go | ||