Apply redactToHost to the 403 scope-hint URL so a userinfo-bearing madtea.url can't echo credentials #275

New issue

Closed

opened 2026-07-19 03:50:56 +00:00 by hexajon · 0 comments

hexajon commented

2026-07-19 03:50:56 +00:00

(Migrated from codeberg.org)

The 403 "required scope" error hint interpolates baseURL + "/user/settings/applications" (internal/gitea/client_errors.go:248), and baseURL is cfg.URL verbatim (client.go:117), never stripped of userinfo. If a user hand-configures madtea.url = https://user:token@host, that userinfo prints into the 403 string.

Severity: low. It is self-inflicted (the operator's own token echoed back to the operator) and is NOT reachable from origin-derived URLs - OriginForgeURL rebuilds https://<host> via ParseRemoteHost and drops userinfo. Flagged only for symmetry: redactToHost is already applied on the redirect-error path but this hint interpolates baseURL raw.

Fix: wrap the interpolated URL in redactToHost(baseURL) here, matching the redirect path.

Acceptance: the 403 hint prints scheme://host only; a test with a userinfo-bearing configured URL asserts no credentials appear.

The 403 "required scope" error hint interpolates `baseURL + "/user/settings/applications"` (`internal/gitea/client_errors.go:248`), and `baseURL` is `cfg.URL` verbatim (`client.go:117`), never stripped of userinfo. If a user hand-configures `madtea.url = https://user:token@host`, that userinfo prints into the 403 string. Severity: low. It is self-inflicted (the operator's own token echoed back to the operator) and is NOT reachable from origin-derived URLs - `OriginForgeURL` rebuilds `https://<host>` via `ParseRemoteHost` and drops userinfo. Flagged only for symmetry: `redactToHost` is already applied on the redirect-error path but this hint interpolates `baseURL` raw. Fix: wrap the interpolated URL in `redactToHost(baseURL)` here, matching the redirect path. Acceptance: the 403 hint prints scheme://host only; a test with a userinfo-bearing configured URL asserts no credentials appear.

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

sixfold-space/madtea#275

No description provided.

Rows
Columns