davrot/forgejo_backup
1
0
Fork 0
mirror of https://codeberg.org/davrot/forgejo.git synced 2025-06-21 20:00:02 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions

fix: url validation in webhook add/edit API (#7932)

Browse source 
Cherry-pick from 972381097c (see #7909).

Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/7932
Reviewed-by: Gusted <gusted@noreply.codeberg.org>
Co-authored-by: Antonin Delpeuch <antonin@delpeuch.eu>
Co-committed-by: Antonin Delpeuch <antonin@delpeuch.eu>
This commit is contained in:
Antonin Delpeuch 2025-05-23 22:50:43 +02:00 • committed by Gusted
parent b2a3966e64
commit 2b30c83a0c
3 changed files with 116 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

9
routers/api/v1/utils/hook.go
View file

@ -16,6 +16,7 @@ import (
"forgejo.org/modules/setting"
api "forgejo.org/modules/structs"
"forgejo.org/modules/util"
"forgejo.org/modules/validation"
webhook_module "forgejo.org/modules/webhook"
"forgejo.org/services/context"
webhook_service "forgejo.org/services/webhook"
@ -93,6 +94,10 @@ func checkCreateHookOption(ctx *context.APIContext, form *api.CreateHookOption)
ctx.Error(http.StatusUnprocessableEntity, "", "Invalid content type")
return false
}
if !validation.IsValidURL(form.Config["url"]) {
ctx.Error(http.StatusUnprocessableEntity, "", "Invalid url")
return false
}
return true
}
@ -322,6 +327,10 @@ func EditRepoHook(ctx *context.APIContext, form *api.EditHookOption, hookID int6
func editHook(ctx *context.APIContext, form *api.EditHookOption, w *webhook.Webhook) bool {
if form.Config != nil {
if url, ok := form.Config["url"]; ok {
if !validation.IsValidURL(url) {
ctx.Error(http.StatusUnprocessableEntity, "", "Invalid url")
return false
}
w.URL = url
}
if ct, ok := form.Config["content_type"]; ok {