This is an automated email from the ASF dual-hosted git repository. asf-gitbox-commits pushed a commit to branch db/8607d in repository https://gitbox.apache.org/repos/asf/allura.git
commit d27ef073a864ebdb872540a8564cebf6b2f7c0e1 Author: Dave Brondsema <[email protected]> AuthorDate: Fri Jun 12 11:36:27 2026 -0400 [#8607] check domain when adding github auth token --- Allura/allura/nf/allura/css/site_style.css | 3 +++ ForgeImporters/forgeimporters/github/__init__.py | 3 ++- ForgeImporters/forgeimporters/tests/github/test_extractor.py | 10 +++++++++- 3 files changed, 14 insertions(+), 2 deletions(-) diff --git a/Allura/allura/nf/allura/css/site_style.css b/Allura/allura/nf/allura/css/site_style.css index b2de89e91..cf871733c 100644 --- a/Allura/allura/nf/allura/css/site_style.css +++ b/Allura/allura/nf/allura/css/site_style.css @@ -2052,6 +2052,9 @@ a.sidebar-disabled:focus { margin-left: -0.5em; margin-top: 0.5em; } +.markdown_content img { + max-width: 100%; +} .media a { float: left; diff --git a/ForgeImporters/forgeimporters/github/__init__.py b/ForgeImporters/forgeimporters/github/__init__.py index adb9085b8..80a86ce17 100644 --- a/ForgeImporters/forgeimporters/github/__init__.py +++ b/ForgeImporters/forgeimporters/github/__init__.py @@ -32,6 +32,7 @@ from formencode import validators as fev from allura.lib.security import is_site_admin +from allura.lib.utils import hostname_from_url from forgeimporters import base from urllib.parse import urlparse @@ -90,7 +91,7 @@ def __init__(self, *args, **kw): def add_token(self, url): headers = {} - if self.token: + if self.token and hostname_from_url(url) == 'api.github.com': # never an outside domain headers['Authorization'] = f'Bearer {self.token}' return url, headers diff --git a/ForgeImporters/forgeimporters/tests/github/test_extractor.py b/ForgeImporters/forgeimporters/tests/github/test_extractor.py index d195f50a2..d2f6d2e77 100644 --- a/ForgeImporters/forgeimporters/tests/github/test_extractor.py +++ b/ForgeImporters/forgeimporters/tests/github/test_extractor.py @@ -130,7 +130,7 @@ def test_get_wiki_url(self): @patch('forgeimporters.base.h.urlopen') def test_urlopen(self, urlopen): e = github.GitHubProjectExtractor('test_project') - url = 'https://github.com/u/p/' + url = 'https://api.github.com/repos/u/p/' e.urlopen(url) request = urlopen.call_args[0][0] assert request.get_full_url() == url @@ -144,6 +144,14 @@ def test_urlopen(self, urlopen): assert request.headers['User-agent'] assert request.headers['Authorization'] == 'Bearer abc' + # token goes only to the API, never to content hosts + for content_url in ('https://user-images.githubusercontent.com/x.png', + 'https://evil.example.com/x.png'): + e.urlopen(content_url) + request = urlopen.call_args[0][0] + assert 'Authorization' not in request.headers + assert 'Authorization' not in request.unredirected_hdrs + @patch('forgeimporters.base.h.urlopen') @patch('forgeimporters.github.time.sleep') @patch('forgeimporters.github.log')
