repo: disallow urlencoded new lines in git protocol paths (#6420)

Co-authored-by: ᴜɴᴋɴᴡᴏɴ <u@gogs.io>

1 files changed, 4 insertions, 0 deletions

diff --git a/internal/form/repo.go b/internal/form/repo.go
index 26acb2bf..ed963307 100644
--- a/internal/form/repo.go
+++ b/internal/form/repo.go
@@ -72,6 +72,10 @@ func (f MigrateRepo) ParseRemoteAddr(user *db.User) (string, error) {
 		if len(f.AuthUsername)+len(f.AuthPassword) > 0 {
 			u.User = url.UserPassword(f.AuthUsername, f.AuthPassword)
 		}
+		// To prevent CRLF injection in git protocol, see https://github.com/gogs/gogs/issues/6413
+		if u.Scheme == "git" && (strings.Contains(remoteAddr, "%0d") || strings.Contains(remoteAddr, "%0a")) {
+			return "", db.ErrInvalidCloneAddr{IsURLError: true}
+		}
 		remoteAddr = u.String()
 	} else if !user.CanImportLocal() {
 		return "", db.ErrInvalidCloneAddr{IsPermissionDenied: true}