Skip to content

WebGUI: Escape character in folder or file name prevents access #17938

@sebveit

Description

@sebveit
  • Gitea version (or commit ref): 1.15.7 built with GNU Make 4.1, go1.16.10 : bindata, sqlite, sqlite_unlock_notify
  • Git version: 2.30.2
  • Operating system: Debian GNU/Linux 11 (bullseye)
  • Database (use [x]):
    • PostgreSQL
    • MySQL
    • MSSQL
    • SQLite
  • Can you reproduce the bug at https://try.gitea.io:

Description

I've cloned a repository from GitHub that uses the percentage character (%) in file and folder names a lot. This %-char prevents the access, via the web GUI of Gitea, to the file or folder containing this char in its name.
It looks like Gitea is displaying the %-char correctly but fails to provide the correct URL when clicking on it.
When I modify the URL and try to access it, nginx answers with 400 Bad Request.

Example

Expected URL: https://try.gitea.io/sebveit/meta-openwrt/src/branch/master/recipes-tweaks/busybox/busybox_%.bbappend
Actual URL: https://try.gitea.io/sebveit/meta-openwrt/src/branch/master/recipes-tweaks/busybox/busybox_%25.bbappend

Reverse Proxy

I'm using nginx (1.18) as a reverse proxy for Gitea. My config for nginx is the following:

server {
    listen 443 ssl;
    server_name gitea.somedomain.tld;
    ssl_certificate     /etc/nginx/ssl/gitea.somedomain.tld.crt;
    ssl_certificate_key /etc/nginx/ssl/gitea.somedomain.tld.key;

    location / {
        proxy_pass http://localhost:3000;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        client_max_body_size 50M;
    }
}

I hope that helps pinpointing the bug. Let me know if you need additional information.
BTW, Gitea is really nice and slim compared to the bloated GitLab.

Metadata

Metadata

Assignees

No one assigned

    Labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions