From 0849735f9eb230ad1bc9866380650b49adf7af92 Mon Sep 17 00:00:00 2001 From: Catherine Date: Sat, 30 May 2026 17:55:26 +0000 Subject: [PATCH] [security] Fix an issue with pull request preview authorization. Pull request number was compared, but pull request owner and repository name were not. As a result you could overwrite any preview site with the matching PR number. This functionality is feature-gated and there are no known usable deployments at the moment. V12-Ref: F-77256 --- src/auth.go | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/src/auth.go b/src/auth.go index 59628c3..e9310e7 100644 --- a/src/auth.go +++ b/src/auth.go @@ -619,6 +619,10 @@ func authorizeForgejoActionRun(repoURL string, forgeToken string, prNumber strin if actionRun.PullRequest == nil { return nil, AuthError{http.StatusUnauthorized, "workflow run not triggered by pull request"} } + prOwner, prRepository := actionRun.PullRequest.OwnerName, actionRun.PullRequest.RepositoryName + if fmt.Sprintf("%s/%s.git", prOwner, prRepository) != parsedRepoURL.Path { + return nil, AuthError{http.StatusUnauthorized, "pull request repository does not match"} + } if fmt.Sprintf("%d", actionRun.PullRequest.Number) != prNumber { return nil, AuthError{http.StatusUnauthorized, "pull request number does not match"} }