eric/ReleaseKit
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 1 Wiki Activity

Verify external assets without forwarding Gitea credentials

Browse Source
This commit is contained in:
Eric Rakestraw
2026-10-06 01:01:36 +00:00
parent 8b417760c6
commit 6b777dd861
4 changed files with 60 additions and 28 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
internal/gitea/assets.go
View File

@@ -161,8 +161,8 @@ func (c Client) downloadHash(ctx context.Context, client *http.Client, base *url
return "", 0, failure(FailureUnverifiable, "download release asset", 0, errors.New("attachment has no download URL"))
}
assetURL, err := base.Parse(rawURL)
if err != nil || !sameOrigin(base, assetURL) || assetURL.User != nil {
return "", 0, failure(FailureUnverifiable, "download release asset", 0, errors.New("asset URL is outside the configured service origin"))
if err != nil || assetURL.User != nil {
return "", 0, failure(FailureUnverifiable, "download release asset", 0, errors.New("invalid attachment URL"))
}
assetURL.Fragment = ""
visited := make(map[string]struct{})
@@ -176,7 +176,9 @@ func (c Client) downloadHash(ctx context.Context, client *http.Client, base *url
if err != nil {
return "", 0, failure(FailureUnverifiable, "download release asset", 0, err)
}
request.Header.Set("Authorization", "token "+token)
if sameOrigin(base, assetURL) {
request.Header.Set("Authorization", "token "+token)
}
request.Header.Set("Accept", "application/octet-stream")
response, err := client.Do(request)
if err != nil {
@@ -185,8 +187,8 @@ func (c Client) downloadHash(ctx context.Context, client *http.Client, base *url
if isRedirect(response.StatusCode) {
location, locationErr := response.Location()
_ = response.Body.Close()
if locationErr != nil || !sameOrigin(base, location) || location.User != nil {
return "", 0, failure(FailureUnverifiable, "redirect release asset", response.StatusCode, errors.New("asset redirect is outside the configured service origin"))
if locationErr != nil || location.User != nil {
return "", 0, failure(FailureUnverifiable, "redirect release asset", response.StatusCode, errors.New("invalid attachment redirect"))
}
location.Fragment = ""
assetURL = location