ajet/gitea
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Replace CSRF cookie with CrossOriginProtection (#36183)

Browse Source 
Removes the CSRF cookie in favor of
[`CrossOriginProtection`](https://pkg.go.dev/net/http#CrossOriginProtection)
which relies purely on HTTP headers.

Fixes: https://github.com/go-gitea/gitea/issues/11188
Fixes: https://github.com/go-gitea/gitea/issues/30333
Helps: https://github.com/go-gitea/gitea/issues/35107

TODOs:

- [x] Fix tests
- [ ] Ideally add tests to validates the protection

---------

Signed-off-by: wxiaoguang <wxiaoguang@gmail.com>
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
This commit is contained in:
silverwind
2025-12-25 11:33:34 +01:00
committed by GitHub
parent eddf875992
commit 42d294941c
207 changed files with 178 additions and 1196 deletions
Download Patch File Download Diff File Expand all files Collapse all files
templates/repo/settings/actions_general.tmpl
-2
View File
@@ -4,7 +4,6 @@
</h4>
<div class="ui attached segment">
<form class="ui form" action="{{.Link}}/actions_unit" method="post">
{{.CsrfTokenHtml}}
{{$isActionsEnabled := .Repository.UnitEnabled ctx ctx.Consts.RepoUnitTypeActions}}
{{$isActionsGlobalDisabled := ctx.Consts.RepoUnitTypeActions.UnitGlobalDisabled}}
<div class="inline field">
@@ -55,7 +54,6 @@
{{end}}
<div class="ui bottom attached segment">
<form class="ui form form-fetch-action" action="{{.Link}}/collaborative_owner/add" method="post">
{{.CsrfTokenHtml}}
<div id="search-user-box" class="ui search input tw-align-middle" data-include-orgs="true">
<input class="prompt" name="collaborative_owner" placeholder="{{ctx.Locale.Tr "search.user_kind"}}" autocomplete="off" autofocus required>
</div>
templates/repo/settings/branches.tmpl
-1
View File
@@ -13,7 +13,6 @@
{{ctx.Locale.Tr "repo.settings.default_branch_desc"}}
</p>
<form class="tw-flex" action="{{.Link}}" method="post">
{{.CsrfTokenHtml}}
<input type="hidden" name="action" value="default_branch">
<div class="ui dropdown selection search tw-flex-1 tw-mr-2 tw-max-w-96">
{{svg "octicon-triangle-down" 14 "dropdown icon"}}
templates/repo/settings/collaboration.tmpl
-2
View File
@@ -40,7 +40,6 @@
{{end}}
<div class="ui bottom attached segment">
<form class="ui form" id="repo-collab-form" action="{{.Link}}" method="post">
{{.CsrfTokenHtml}}
<div id="search-user-box" class="ui search input tw-align-middle">
<input class="prompt" name="collaborator" placeholder="{{ctx.Locale.Tr "search.user_kind"}}" autocomplete="off" autofocus required>
</div>
@@ -108,7 +107,6 @@
<div class="ui bottom attached segment">
{{if $allowedToChangeTeams}}
<form class="ui form" id="repo-collab-team-form" action="{{.Link}}/team" method="post">
{{.CsrfTokenHtml}}
<div id="search-team-box" class="ui search input tw-align-middle" data-org-name="{{.OrgName}}">
<input class="prompt" name="team" placeholder="{{ctx.Locale.Tr "search.team_kind"}}" autocomplete="off" required>
</div>
templates/repo/settings/deploy_keys.tmpl
-1
View File
@@ -13,7 +13,6 @@
<div class="ui attached segment">
<div class="{{if not .HasError}}tw-hidden{{end}} tw-mb-4" id="add-deploy-key-panel">
<form class="ui form" action="{{.Link}}" method="post">
{{.CsrfTokenHtml}}
<div class="field">
{{ctx.Locale.Tr "repo.settings.deploy_key_desc"}}
</div>
templates/repo/settings/githook_edit.tmpl
-1
View File
@@ -6,7 +6,6 @@
<div class="ui attached segment">
<p>{{ctx.Locale.Tr "repo.settings.githook_edit_desc"}}</p>
<form class="ui form" action="{{.Link}}" method="post">
{{.CsrfTokenHtml}}
{{with .Hook}}
<div class="inline field">
<label>{{ctx.Locale.Tr "repo.settings.githook_name"}}</label>
templates/repo/settings/lfs.tmpl
-1
View File
@@ -43,7 +43,6 @@
{{ctx.Locale.Tr "repo.settings.lfs_delete_warning"}}
</p>
<form class="ui form" action="{{$.Link}}/delete/{{.Oid}}" method="post">
{{$.CsrfTokenHtml}}
{{template "base/modal_actions_confirm"}}
</form>
</div>
templates/repo/settings/lfs_locks.tmpl
-2
View File
@@ -6,7 +6,6 @@
</h4>
<div class="ui attached segment">
<form class="ui form ignore-dirty" method="post">
{{$.CsrfTokenHtml}}
<div class="ui fluid action input">
<input name="path" value="" placeholder="{{ctx.Locale.Tr "repo.settings.lfs_lock_path"}}" autofocus>
<button class="ui primary button">{{ctx.Locale.Tr "repo.settings.lfs_lock"}}</button>
@@ -38,7 +37,6 @@
<td>{{DateUtils.TimeSince .Created}}</td>
<td class="tw-text-right">
<form action="{{$.LFSFilesLink}}/locks/{{$lock.ID}}/unlock" method="post">
{{$.CsrfTokenHtml}}
<button class="ui primary button"><span class="btn-octicon">{{svg "octicon-lock"}}</span>{{ctx.Locale.Tr "repo.settings.lfs_force_unlock"}}</button>
</form>
</td>
templates/repo/settings/lfs_pointers.tmpl
-1
View File
@@ -5,7 +5,6 @@
{{if gt .NumAssociatable 0}}
<div class="ui right">
<form class="ui form" method="post" action="{{$.Link}}/associate">
{{.CsrfTokenHtml}}
{{range .Pointers}}
{{if .Associatable}}
<input type="hidden" name="oid" value="{{.Oid}} {{.Size}}">
templates/repo/settings/options.tmpl
-19
View File
@@ -6,7 +6,6 @@
<div class="ui attached segment">
<form class="ui form" action="{{.Link}}" method="post">
{{template "base/disable_form_autofill"}}
{{.CsrfTokenHtml}}
<input type="hidden" name="action" value="update">
<div class="required field {{if .Err_RepoName}}error{{end}}">
<label>{{ctx.Locale.Tr "repo.repo_name"}}</label>
@@ -38,7 +37,6 @@
<div class="divider"></div>
<form class="ui form" action="{{.Link}}/avatar" method="post" enctype="multipart/form-data">
{{.CsrfTokenHtml}}
<div class="inline field">
{{template "shared/avatar_upload_crop" dict "LabelText" (ctx.Locale.Tr "settings.choose_new_avatar")}}
</div>
@@ -119,7 +117,6 @@
<td>{{DateUtils.FullTime .PullMirror.UpdatedUnix}}</td>
<td class="tw-text-right">
<form method="post" class="tw-inline-block">
{{.CsrfTokenHtml}}
<input type="hidden" name="action" value="mirror-sync">
<button class="ui primary tiny button inline">{{ctx.Locale.Tr "repo.settings.sync_mirror"}}</button>
</form>
@@ -129,7 +126,6 @@
<td colspan="4">
<form class="ui form" method="post">
{{template "base/disable_form_autofill"}}
{{.CsrfTokenHtml}}
<input type="hidden" name="action" value="mirror">
<div class="inline field {{if .Err_EnablePrune}}error{{end}}">
<label>{{ctx.Locale.Tr "repo.mirror_prune"}}</label>
@@ -226,13 +222,11 @@
{{svg "octicon-pencil" 14}}
</button>
<form method="post" class="tw-inline-block">
{{$.CsrfTokenHtml}}
<input type="hidden" name="action" value="push-mirror-sync">
<input type="hidden" name="push_mirror_id" value="{{.ID}}">
<button class="ui primary tiny button" data-tooltip-content="{{ctx.Locale.Tr "repo.settings.sync_mirror"}}">{{svg "octicon-sync" 14}}</button>
</form>
<form method="post" class="tw-inline-block">
{{$.CsrfTokenHtml}}
<input type="hidden" name="action" value="push-mirror-remove">
<input type="hidden" name="push_mirror_id" value="{{.ID}}">
<button class="ui basic red tiny button" data-tooltip-content="{{ctx.Locale.Tr "remove"}}">{{svg "octicon-trash" 14}}</button>
@@ -249,7 +243,6 @@
<td colspan="4">
<form class="ui form" method="post">
{{template "base/disable_form_autofill"}}
{{.CsrfTokenHtml}}
<input type="hidden" name="action" value="push-mirror-add">
<div class="field {{if .Err_PushMirrorAddress}}error{{end}}">
<label for="push_mirror_address">{{ctx.Locale.Tr "repo.settings.mirror_settings.push_mirror.remote_url"}}</label>
@@ -299,7 +292,6 @@
</h4>
<div class="ui attached segment">
<form class="ui form" method="post">
{{.CsrfTokenHtml}}
<input type="hidden" name="action" value="advanced">
{{$isCodeEnabled := .Repository.UnitEnabled ctx ctx.Consts.RepoUnitTypeCode}}
@@ -647,7 +639,6 @@
</h4>
<div class="ui attached segment">
<form class="ui form" method="post">
{{.CsrfTokenHtml}}
<input type="hidden" name="action" value="signing">
<div class="field">
<label>{{ctx.Locale.Tr "repo.settings.trust_model"}}</label><br>
@@ -694,7 +685,6 @@
</h4>
<div class="ui attached segment">
<form class="ui form" method="post">
{{.CsrfTokenHtml}}
<input type="hidden" name="action" value="admin">
<div class="field">
<div class="ui checkbox">
@@ -710,7 +700,6 @@
<div class="divider"></div>
<form class="ui form" method="post">
{{.CsrfTokenHtml}}
<input type="hidden" name="action" value="admin_index">
{{if .IsRepoIndexerEnabled}}
<h4 class="ui header">{{ctx.Locale.Tr "repo.settings.admin_code_indexer"}}</h4>
@@ -815,7 +804,6 @@
<div class="flex-item-trailing">
{{if .RepoTransfer}}
<form class="ui form" action="{{.Link}}" method="post">
{{.CsrfTokenHtml}}
<input type="hidden" name="action" value="cancel_transfer">
<button class="ui red button">{{ctx.Locale.Tr "repo.settings.transfer_abort"}}</button>
</form>
@@ -883,7 +871,6 @@
{{ctx.Locale.Tr "repo.settings.convert_notices_1"}}
</div>
<form class="ui form" action="{{.Link}}" method="post">
{{.CsrfTokenHtml}}
<input type="hidden" name="action" value="convert">
<div class="field">
<label>
@@ -914,7 +901,6 @@
{{ctx.Locale.Tr "repo.settings.convert_fork_notices_1"}}
</div>
<form class="ui form" action="{{.Link}}" method="post">
{{.CsrfTokenHtml}}
<input type="hidden" name="action" value="convert_fork">
<div class="field">
<label>
@@ -947,7 +933,6 @@
{{ctx.Locale.Tr "repo.settings.transfer_notices_4"}}
</div>
<form class="ui form" action="{{.Link}}" method="post">
{{.CsrfTokenHtml}}
<input type="hidden" name="action" value="transfer">
<div class="field">
<label>
@@ -985,7 +970,6 @@
{{end}}
</div>
<form class="ui form" action="{{.Link}}" method="post">
{{.CsrfTokenHtml}}
<input type="hidden" name="action" value="delete">
<div class="field">
<label>
@@ -1026,7 +1010,6 @@
{{end}}
</div>
<form action="{{.Link}}" method="post">
{{.CsrfTokenHtml}}
<input type="hidden" name="action" value="visibility">
<input type="hidden" name="repo_id" value="{{.Repository.ID}}">
{{template "base/modal_actions_confirm" .}}
@@ -1045,7 +1028,6 @@
{{ctx.Locale.Tr "repo.settings.wiki_delete_notices_1" .Repository.Name}}
</div>
<form class="ui form" action="{{.Link}}" method="post">
{{.CsrfTokenHtml}}
<input type="hidden" name="action" value="delete-wiki">
<div class="field">
<label>
@@ -1086,7 +1068,6 @@
</p>
</div>
<form action="{{.Link}}" method="post">
{{.CsrfTokenHtml}}
<input type="hidden" name="action" value="{{if .Repository.IsArchived}}unarchive{{else}}archive{{end}}">
<input type="hidden" name="repo_id" value="{{.Repository.ID}}">
{{template "base/modal_actions_confirm" .}}
templates/repo/settings/protected_branch.tmpl
-1
View File
@@ -27,7 +27,6 @@
<p class="help tw-ml-0">{{ctx.Locale.Tr "repo.settings.protect_unprotected_file_patterns_desc" "https://pkg.go.dev/github.com/gobwas/glob#Compile" "github.com/gobwas/glob"}}</p>
</div>
{{.CsrfTokenHtml}}
<h5 class="ui dividing header">{{ctx.Locale.Tr "repo.settings.event_push"}}</h5>
<div class="field">
<div class="ui radio checkbox">
templates/repo/settings/public_access.tmpl
-1
View File
@@ -12,7 +12,6 @@
{{$paEveryoneRead := "everyone-read"}}
{{$paEveryoneWrite := "everyone-write"}}
<form class="ui form" method="post">
{{.CsrfTokenHtml}}
<table class="ui table unstackable tw-my-2">
<thead>
<tr>
templates/repo/settings/push_mirror_sync_modal.tmpl
-1
View File
@@ -3,7 +3,6 @@
{{ctx.Locale.Tr "repo.settings.mirror_settings.push_mirror.edit_sync_time"}}
</div>
<form class="content ui form ignore-dirty" method="post">
{{.CsrfTokenHtml}}
<input type="hidden" name="action" value="push-mirror-update">
<input type="hidden" name="push_mirror_id" id="push-mirror-edit-id">
<div class="field">
templates/repo/settings/tags.tmpl
-2
View File
@@ -14,7 +14,6 @@
<div class="sixteen wide column">
<div class="ui segment">
<form class="ui form" action="{{.Link}}" method="post">
{{.CsrfTokenHtml}}
<div class="field">
<label>{{ctx.Locale.Tr "repo.settings.tags.protection.pattern"}}</label>
<div id="search-tag-box" class="ui search">
@@ -107,7 +106,6 @@
<td class="tw-text-right">
<a class="ui tiny primary button" href="{{$.RepoLink}}/settings/tags/{{.ID}}">{{ctx.Locale.Tr "edit"}}</a>
<form class="tw-inline-block" action="{{$.RepoLink}}/settings/tags/delete" method="post">
{{$.CsrfTokenHtml}}
<input type="hidden" name="id" value="{{.ID}}">
<button class="ui tiny red button">{{ctx.Locale.Tr "remove"}}</button>
</form>
templates/repo/settings/webhook/dingtalk.tmpl
-1
View File
@@ -1,7 +1,6 @@
{{if eq .HookType "dingtalk"}}
<p>{{ctx.Locale.Tr "repo.settings.add_web_hook_desc" "https://dingtalk.com" (ctx.Locale.Tr "repo.settings.web_hook_name_dingtalk")}}</p>
<form class="ui form" action="{{.BaseLink}}/dingtalk/{{or .Webhook.ID "new"}}" method="post">
{{.CsrfTokenHtml}}
<div class="required field {{if .Err_PayloadURL}}error{{end}}">
<label for="payload_url">{{ctx.Locale.Tr "repo.settings.payload_url"}}</label>
<input id="payload_url" name="payload_url" type="url" value="{{.Webhook.URL}}" autofocus required>
templates/repo/settings/webhook/discord.tmpl
-1
View File
@@ -1,7 +1,6 @@
{{if eq .HookType "discord"}}
<p>{{ctx.Locale.Tr "repo.settings.add_web_hook_desc" "https://discord.com" (ctx.Locale.Tr "repo.settings.web_hook_name_discord")}}</p>
<form class="ui form" action="{{.BaseLink}}/discord/{{or .Webhook.ID "new"}}" method="post">
{{.CsrfTokenHtml}}
<div class="required field {{if .Err_PayloadURL}}error{{end}}">
<label for="payload_url">{{ctx.Locale.Tr "repo.settings.payload_url"}}</label>
<input id="payload_url" name="payload_url" type="url" value="{{.Webhook.URL}}" autofocus required>
templates/repo/settings/webhook/feishu.tmpl
-1
View File
@@ -4,7 +4,6 @@
{{ctx.Locale.Tr "repo.settings.add_web_hook_desc" "https://larksuite.com" (ctx.Locale.Tr "repo.settings.web_hook_name_larksuite")}}
</p>
<form class="ui form" action="{{.BaseLink}}/feishu/{{or .Webhook.ID "new"}}" method="post">
{{.CsrfTokenHtml}}
<div class="required field {{if .Err_PayloadURL}}error{{end}}">
<label for="payload_url">{{ctx.Locale.Tr "repo.settings.payload_url"}}</label>
<input id="payload_url" name="payload_url" type="url" value="{{.Webhook.URL}}" autofocus required>
templates/repo/settings/webhook/gitea.tmpl
-1
View File
@@ -2,7 +2,6 @@
<p>{{ctx.Locale.Tr "repo.settings.add_web_hook_desc" "https://docs.gitea.com/usage/webhooks" (ctx.Locale.Tr "repo.settings.web_hook_name_gitea")}}</p>
<form class="ui form" action="{{.BaseLink}}/gitea/{{or .Webhook.ID "new"}}" method="post">
{{template "base/disable_form_autofill"}}
{{.CsrfTokenHtml}}
<div class="required field {{if .Err_PayloadURL}}error{{end}}">
<label for="payload_url">{{ctx.Locale.Tr "repo.settings.payload_url"}}</label>
<input id="payload_url" name="payload_url" type="url" value="{{.Webhook.URL}}" autofocus required>
templates/repo/settings/webhook/gogs.tmpl
-1
View File
@@ -2,7 +2,6 @@
<p>{{ctx.Locale.Tr "repo.settings.add_web_hook_desc" "https://docs.gitea.com/usage/webhooks" (ctx.Locale.Tr "repo.settings.web_hook_name_gogs")}}</p>
<form class="ui form" action="{{.BaseLink}}/gogs/{{or .Webhook.ID "new"}}" method="post">
{{template "base/disable_form_autofill"}}
{{.CsrfTokenHtml}}
<div class="required field {{if .Err_PayloadURL}}error{{end}}">
<label for="payload_url">{{ctx.Locale.Tr "repo.settings.payload_url"}}</label>
<input id="payload_url" name="payload_url" type="url" value="{{.Webhook.URL}}" autofocus required>
templates/repo/settings/webhook/history.tmpl
-1
View File
@@ -52,7 +52,6 @@
{{if or $.Permission.IsAdmin $.IsOrganizationOwner $.PageIsAdmin $.PageIsUserSettings}}
<div class="right menu">
<form class="tw-py-2" action="{{$.Link}}/replay/{{.UUID}}" method="post">
{{$.CsrfTokenHtml}}
<span data-tooltip-content="{{if $.Webhook.IsActive}}{{ctx.Locale.Tr "repo.settings.webhook.replay.description"}}{{else}}{{ctx.Locale.Tr "repo.settings.webhook.replay.description_disabled"}}{{end}}">
<button class="ui tiny button tw-mr-0{{if not $.Webhook.IsActive}} disabled{{end}}">{{svg "octicon-sync"}}</button>
</span>
templates/repo/settings/webhook/matrix.tmpl
-1
View File
@@ -1,7 +1,6 @@
{{if eq .HookType "matrix"}}
<p>{{ctx.Locale.Tr "repo.settings.add_web_hook_desc" "https://matrix.org/" (ctx.Locale.Tr "repo.settings.web_hook_name_matrix")}}</p>
<form class="ui form" action="{{.BaseLink}}/matrix/{{or .Webhook.ID "new"}}" method="post">
{{.CsrfTokenHtml}}
<div class="required field {{if .Err_HomeserverURL}}error{{end}}">
<label for="homeserver_url">{{ctx.Locale.Tr "repo.settings.matrix.homeserver_url"}}</label>
<input id="homeserver_url" name="homeserver_url" type="url" value="{{.MatrixHook.HomeserverURL}}" autofocus required>
templates/repo/settings/webhook/msteams.tmpl
-1
View File
@@ -1,7 +1,6 @@
{{if eq .HookType "msteams"}}
<p>{{ctx.Locale.Tr "repo.settings.add_web_hook_desc" "https://teams.microsoft.com" (ctx.Locale.Tr "repo.settings.web_hook_name_msteams")}}</p>
<form class="ui form" action="{{.BaseLink}}/msteams/{{or .Webhook.ID "new"}}" method="post">
{{.CsrfTokenHtml}}
<div class="required field {{if .Err_PayloadURL}}error{{end}}">
<label for="payload_url">{{ctx.Locale.Tr "repo.settings.payload_url"}}</label>
<input id="payload_url" name="payload_url" type="url" value="{{.Webhook.URL}}" autofocus required>
templates/repo/settings/webhook/packagist.tmpl
-1
View File
@@ -1,7 +1,6 @@
{{if eq .HookType "packagist"}}
<p>{{ctx.Locale.Tr "repo.settings.add_web_hook_desc" "https://packagist.org" (ctx.Locale.Tr "repo.settings.web_hook_name_packagist")}}</p>
<form class="ui form" action="{{.BaseLink}}/packagist/{{or .Webhook.ID "new"}}" method="post">
{{.CsrfTokenHtml}}
<div class="required field {{if .Err_Username}}error{{end}}">
<label for="username">{{ctx.Locale.Tr "repo.settings.packagist_username"}}</label>
<input id="username" name="username" value="{{.PackagistHook.Username}}" placeholder="Gitea" autofocus required>
templates/repo/settings/webhook/slack.tmpl
-1
View File
@@ -1,7 +1,6 @@
{{if eq .HookType "slack"}}
<p>{{ctx.Locale.Tr "repo.settings.add_web_hook_desc" "https://slack.com" (ctx.Locale.Tr "repo.settings.web_hook_name_slack")}}</p>
<form class="ui form" action="{{.BaseLink}}/slack/{{or .Webhook.ID "new"}}" method="post">
{{.CsrfTokenHtml}}
<div class="required field {{if .Err_PayloadURL}}error{{end}}">
<label for="payload_url">{{ctx.Locale.Tr "repo.settings.payload_url"}}</label>
<input id="payload_url" name="payload_url" type="url" value="{{.Webhook.URL}}" autofocus required>
templates/repo/settings/webhook/telegram.tmpl
-1
View File
@@ -1,7 +1,6 @@
{{if eq .HookType "telegram"}}
<p>{{ctx.Locale.Tr "repo.settings.add_web_hook_desc" "https://core.telegram.org/bots" (ctx.Locale.Tr "repo.settings.web_hook_name_telegram")}}</p>
<form class="ui form" action="{{.BaseLink}}/telegram/{{or .Webhook.ID "new"}}" method="post">
{{.CsrfTokenHtml}}
<div class="required field {{if .Err_BotToken}}error{{end}}">
<label for="bot_token">{{ctx.Locale.Tr "repo.settings.bot_token"}}</label>
<input id="bot_token" name="bot_token" type="text" value="{{.TelegramHook.BotToken}}" autofocus required>
templates/repo/settings/webhook/wechatwork.tmpl
-1
View File
@@ -1,7 +1,6 @@
{{if eq .HookType "wechatwork"}}
<p>{{ctx.Locale.Tr "repo.settings.add_web_hook_desc" "https://work.weixin.qq.com" (ctx.Locale.Tr "repo.settings.web_hook_name_wechatwork")}}</p>
<form class="ui form" action="{{.BaseLink}}/wechatwork/{{or .Webhook.ID "new"}}" method="post">
{{.CsrfTokenHtml}}
<div class="required field {{if .Err_PayloadURL}}error{{end}}">
<label for="payload_url">{{ctx.Locale.Tr "repo.settings.payload_url"}}</label>
<input id="payload_url" name="payload_url" type="url" value="{{.Webhook.URL}}" autofocus required>