Possibly a problem: it seems like people can get a valid CSRF token through that, as they seem to not be limited to an IP address!
I'd suggest to only map raw.codeberg.org/{username}/{repo}/{...} to codeberg.org/{username}/{repo}/raw/{...}, and only serve the response when it's 200 OK
Possibly a problem: it seems like people can get a valid CSRF token through that, as they seem to not be limited to an IP address!
I'd suggest to only map `raw.codeberg.org/{username}/{repo}/{...}` to `codeberg.org/{username}/{repo}/raw/{...}`, and only serve the response when it's `200 OK`
Nonono, the CSRF token is in the content of the response! We should explicitly only allow raw files from repositories (raw.codeberg.org/username/repo/branch/main/filename.txt), instead of any Gitea URL (like raw.codeberg.org/user/settings, even if cookies are stripped).
Nonono, the CSRF token is in the content of the response! We should explicitly *only* allow raw files from repositories (`raw.codeberg.org/username/repo/branch/main/filename.txt`), instead of any Gitea URL (like `raw.codeberg.org/user/settings`, even if cookies are stripped).
That doesn't matter - replace it with .page or whatever. IMO it should definitely only be possible to get files from repositories via the .page TLD, and make sure to never expose Gitea resources like the API, or HTML pages.
That doesn't matter - replace it with .page or whatever. IMO it should definitely only be possible to get files from repositories via the .page TLD, and make sure to never expose Gitea resources like the API, or HTML pages.
Does this limit in any way the accessible pages? Like can I get the source of my user account page by going to raw.codeberg.org/momar?
It recognizes permissions (hidden repos get 404 which is not the case currently).
Possibly a problem: it seems like people can get a valid CSRF token through that, as they seem to not be limited to an IP address!
I'd suggest to only map
raw.codeberg.org/{username}/{repo}/{...}
tocodeberg.org/{username}/{repo}/raw/{...}
, and only serve the response when it's200 OK
So we should strip the headers?
(just like the cookie?)
Nonono, the CSRF token is in the content of the response! We should explicitly only allow raw files from repositories (
raw.codeberg.org/username/repo/branch/main/filename.txt
), instead of any Gitea URL (likeraw.codeberg.org/user/settings
, even if cookies are stripped).never from .org I guess?
That doesn't matter - replace it with .page or whatever. IMO it should definitely only be possible to get files from repositories via the .page TLD, and make sure to never expose Gitea resources like the API, or HTML pages.
agree