metsw24-max 0c67849e68 fix(packages): validate debian distribution and component names (#38116) ...

**Newline injection into the Debian Release and Packages indices**

The `distribution` and `component` come straight from the request path
and are written line by line into the generated `Release` and `Packages`
files (the `Suite`/`Codename`/`Components` lines and the `Filename:
pool/<distribution>/<component>/...` line), but `UploadPackageFile` only
checked they were non-empty. `ctx.PathParam` url-decodes the segment, so
an encoded newline such as `main%0AInjected-Field: x` is accepted,
stored and then re-emitted for that distribution, which lets an
authenticated uploader forge extra fields in the index apt consumes.
Restricted both values to a conservative name pattern in the handler,
since that is the layer that accepts them; this should also keep the
pool paths well formed.

---------

Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>

2026-06-29 06:50:22 +00:00

..

api

fix(packages): validate debian distribution and component names (#38116)

2026-06-29 06:50:22 +00:00

common

feat(api): support ref suffixes in compare (#38148)

2026-06-24 05:38:02 +00:00

install

chore: Move import path from code.gitea.io/gitea to gitea.dev (#37873)

2026-05-26 15:49:31 -07:00

private

fix: Various security fixes (#38103)

2026-06-17 16:06:51 +00:00

utils

Refactor flash message and remove SanitizeHTML template func (#37179)

2026-04-12 10:17:25 +08:00

web

fix(actions): address workflow status badge review feedback (#38241)

2026-06-28 10:53:01 +00:00

init.go

chore: Move import path from code.gitea.io/gitea to gitea.dev (#37873)

2026-05-26 15:49:31 -07:00