You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
The function getPostgreSQLConnectionString in modules/setting/database.go parse the dbhost, and it works like:
host, port := parsePostgreSQLHostPort(dbHost)
if host[0] == '/' { // looks like a unix socket
...
but it just split host-string with :. If the provided host-string starts with :, the host will be "", and it will trigger an error like index out of range [0] with length 0
The poc is here:
package main
import"code.gitea.io/gitea/modules/setting"funcmain() {
setting.Database.Type="postgres"setting.Database.Host=":00000"_, _=setting.DBConnStr()
}
* Use default values when provided values are empty
- When provided values are empty like `:3000` would imply that host is
empty, use the default value.
- Resolves#20316
* Update database.go
Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
vsysoev
pushed a commit
to IntegraSDL/gitea
that referenced
this issue
Aug 10, 2022
* Use default values when provided values are empty
- When provided values are empty like `:3000` would imply that host is
empty, use the default value.
- Resolvesgo-gitea#20316
* Update database.go
Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
Description
The function
getPostgreSQLConnectionString
in modules/setting/database.go parse the dbhost, and it works like:but it just split host-string with
:
. If the provided host-string starts with:
, the host will be "", and it will trigger an error likeindex out of range [0] with length 0
The poc is here:
And it crashed as :
Gitea Version
with git commit as ee769f7
Can you reproduce the bug on the Gitea demo site?
No
Log Gist
No response
Screenshots
No response
Git Version
No response
Operating System
No response
How are you running Gitea?
I test the API in Gitea through go-fuzz
Database
No response
The text was updated successfully, but these errors were encountered: