diff options
Diffstat (limited to 'internal/db')
| -rw-r--r-- | internal/db/error.go | 11 | ||||
| -rw-r--r-- | internal/db/webhook.go | 6 |
2 files changed, 12 insertions, 5 deletions
diff --git a/internal/db/error.go b/internal/db/error.go index d1668d99..f754df6d 100644 --- a/internal/db/error.go +++ b/internal/db/error.go @@ -194,9 +194,10 @@ func (err ErrLastOrgOwner) Error() string { // \/ \/|__| \/ \/ type ErrInvalidCloneAddr struct { - IsURLError bool - IsInvalidPath bool - IsPermissionDenied bool + IsURLError bool + IsInvalidPath bool + IsPermissionDenied bool + IsBlockedLocalAddress bool } func IsErrInvalidCloneAddr(err error) bool { @@ -205,8 +206,8 @@ func IsErrInvalidCloneAddr(err error) bool { } func (err ErrInvalidCloneAddr) Error() string { - return fmt.Sprintf("invalid clone address [is_url_error: %v, is_invalid_path: %v, is_permission_denied: %v]", - err.IsURLError, err.IsInvalidPath, err.IsPermissionDenied) + return fmt.Sprintf("invalid clone address [is_url_error: %v, is_invalid_path: %v, is_permission_denied: %v, is_blocked_local_address: %v]", + err.IsURLError, err.IsInvalidPath, err.IsPermissionDenied, err.IsBlockedLocalAddress) } type ErrUpdateTaskNotExist struct { diff --git a/internal/db/webhook.go b/internal/db/webhook.go index bca1fb91..fee3d1ec 100644 --- a/internal/db/webhook.go +++ b/internal/db/webhook.go @@ -24,6 +24,7 @@ import ( "gogs.io/gogs/internal/conf" "gogs.io/gogs/internal/errutil" "gogs.io/gogs/internal/httplib" + "gogs.io/gogs/internal/netutil" "gogs.io/gogs/internal/sync" ) @@ -688,6 +689,11 @@ func TestWebhook(repo *Repository, event HookEventType, p api.Payloader, webhook } func (t *HookTask) deliver() { + if netutil.IsBlockedLocalHostname(t.URL, conf.Security.LocalNetworkAllowlist) { + t.ResponseContent = "Payload URL resolved to a local network address that is implicitly blocked." + return + } + t.IsDelivered = true timeout := time.Duration(conf.Webhook.DeliverTimeout) * time.Second |