From 9219534447411f6ffe507fee64f89c619c29d501 Mon Sep 17 00:00:00 2001 From: wxiaoguang Date: Wed, 26 Apr 2023 02:35:50 +0800 Subject: [PATCH] Fix incorrect CORS response in Http Git handler (#24303) Use the general `cors.Handler` for CORS --- routers/web/repo/http.go | 54 ++++++++++++++++------------------------ routers/web/web.go | 2 +- 2 files changed, 22 insertions(+), 34 deletions(-) diff --git a/routers/web/repo/http.go b/routers/web/repo/http.go index cd32d99533..a01bb4f28e 100644 --- a/routers/web/repo/http.go +++ b/routers/web/repo/http.go @@ -32,43 +32,31 @@ import ( "code.gitea.io/gitea/modules/structs" "code.gitea.io/gitea/modules/util" repo_service "code.gitea.io/gitea/services/repository" + + "github.com/go-chi/cors" ) +func HTTPGitEnabledHandler(ctx *context.Context) { + if setting.Repository.DisableHTTPGit { + ctx.Resp.WriteHeader(http.StatusForbidden) + _, _ = ctx.Resp.Write([]byte("Interacting with repositories by HTTP protocol is not allowed")) + } +} + +func CorsHandler() func(next http.Handler) http.Handler { + if setting.Repository.AccessControlAllowOrigin != "" { + return cors.Handler(cors.Options{ + AllowedOrigins: []string{setting.Repository.AccessControlAllowOrigin}, + AllowedHeaders: []string{"Content-Type", "Authorization", "User-Agent"}, + }) + } + return func(next http.Handler) http.Handler { + return next + } +} + // httpBase implementation git smart HTTP protocol func httpBase(ctx *context.Context) (h *serviceHandler) { - if setting.Repository.DisableHTTPGit { - ctx.Resp.WriteHeader(http.StatusForbidden) - _, err := ctx.Resp.Write([]byte("Interacting with repositories by HTTP protocol is not allowed")) - if err != nil { - log.Error(err.Error()) - } - return - } - - if len(setting.Repository.AccessControlAllowOrigin) > 0 { - allowedOrigin := setting.Repository.AccessControlAllowOrigin - // Set CORS headers for browser-based git clients - ctx.Resp.Header().Set("Access-Control-Allow-Origin", allowedOrigin) - ctx.Resp.Header().Set("Access-Control-Allow-Headers", "Content-Type, Authorization, User-Agent") - - // Handle preflight OPTIONS request - if ctx.Req.Method == "OPTIONS" { - if allowedOrigin == "*" { - ctx.Status(http.StatusOK) - } else if allowedOrigin == "null" { - ctx.Status(http.StatusForbidden) - } else { - origin := ctx.Req.Header.Get("Origin") - if len(origin) > 0 && origin == allowedOrigin { - ctx.Status(http.StatusOK) - } else { - ctx.Status(http.StatusForbidden) - } - } - return - } - } - username := ctx.Params(":username") reponame := strings.TrimSuffix(ctx.Params(":reponame"), ".git") diff --git a/routers/web/web.go b/routers/web/web.go index 9d1bd90d93..af39059325 100644 --- a/routers/web/web.go +++ b/routers/web/web.go @@ -1515,7 +1515,7 @@ func RegisterRoutes(m *web.Route) { m.GetOptions("/objects/{head:[0-9a-f]{2}}/{hash:[0-9a-f]{38}}", repo.GetLooseObject) m.GetOptions("/objects/pack/pack-{file:[0-9a-f]{40}}.pack", repo.GetPackFile) m.GetOptions("/objects/pack/pack-{file:[0-9a-f]{40}}.idx", repo.GetIdxFile) - }, ignSignInAndCsrf, context_service.UserAssignmentWeb()) + }, ignSignInAndCsrf, repo.HTTPGitEnabledHandler, repo.CorsHandler(), context_service.UserAssignmentWeb()) }) }) // ***** END: Repository *****