mirror of
https://github.com/go-gitea/gitea.git
synced 2026-10-01 20:59:45 +09:00
TheFox0x7
1b1274486c
Introduces gitproxy module which spawns a small forward proxy as scanner for git calls Replaces hostmatcher with matchlist which supports port rules Deprecates ALLOWED_DOMAINS/BLOCKED_DOMAINS and ALLOW_LOCALNETWORKS settings in migration in favor of full names we have in security configs. Removes `external` preset in favor of lax/strict modes, strict mode requiring explicit ports if they aren't standard http/s ones. Breaking changes: - `external` preset no longer works as deny rule. To enforce that, use `strict` mode and allow ranges to connect to - Wildcards are no longer accepted in IP addresses - `*` is no longer allowed as entry in lists - domain rules now use curl like syntax `*.example.com` matching subdomains but not `example.com`, `example.com` matching itself and all subdomains. `example.*` is not a valid rule - In the default `lax` mode, `[security] ALLOWED_HOST_LIST` no longer restricts public hosts, set `EGRESS_MODE = strict` to keep an exclusive list. A startup warning flags this - Invalid list entries are logged at startup, invalid `BLOCKED_HOST_LIST`/`BLOCKED_DOMAINS` entries stop it Docs: https://gitea.com/gitea/docs/pulls/557 Signed-off-by: wxiaoguang <wxiaoguang@gmail.com> Co-authored-by: silverwind <me@silverwind.io> Co-authored-by: bircni <bircni@icloud.com> Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
50 lines
1.4 KiB
Go
50 lines
1.4 KiB
Go
// Copyright 2017 The Gitea Authors. All rights reserved.
|
|
// SPDX-License-Identifier: MIT
|
|
|
|
package openid
|
|
|
|
import (
|
|
"net/http"
|
|
"sync"
|
|
"time"
|
|
|
|
"gitea.dev/modules/egress"
|
|
|
|
"github.com/yohcop/openid-go"
|
|
)
|
|
|
|
// For the demo, we use in-memory infinite storage nonce and discovery
|
|
// cache. In your app, do not use this as it will eat up memory and
|
|
// never
|
|
// free it. Use your own implementation, on a better database system.
|
|
// If you have multiple servers for example, you may need to share at
|
|
// least
|
|
// the nonceStore between them.
|
|
var (
|
|
nonceStore = openid.NewSimpleNonceStore()
|
|
discoveryCache = newTimedDiscoveryCache(24 * time.Hour)
|
|
|
|
// openIDInstance keeps user-supplied OpenID identifiers within [security] ALLOWED_HOST_LIST
|
|
openIDInstance = sync.OnceValue(func() *openid.OpenID {
|
|
return openid.NewOpenID(&http.Client{
|
|
Timeout: 30 * time.Second,
|
|
Transport: egress.NewSecurityPolicy("openid").NewHTTPTransport(),
|
|
})
|
|
})
|
|
)
|
|
|
|
// Verify handles response from OpenID provider
|
|
func Verify(fullURL string) (id string, err error) {
|
|
return openIDInstance().Verify(fullURL, discoveryCache, nonceStore)
|
|
}
|
|
|
|
// Normalize normalizes an OpenID URI
|
|
func Normalize(url string) (id string, err error) {
|
|
return openid.Normalize(url)
|
|
}
|
|
|
|
// RedirectURL redirects browser
|
|
func RedirectURL(id, callbackURL, realm string) (string, error) {
|
|
return openIDInstance().RedirectURL(id, callbackURL, realm)
|
|
}
|