stackchain/stackchain-dashboard
1
0
Fork 0
Code Issues 9 Pull Requests 1 Actions Packages Projects Releases 713 Wiki Activity

Keep dashboard Gitea links on the configured forge origin #1072

New Issue
Closed
opened 2026-08-18 08:49:52 +00:00 by rockachopa · 0 comments
rockachopa commented 2026-08-18 08:49:52 +00:00
Member
Copy Link

Problem

Dashboard API normalization accepts arbitrary absolute HTTP(S) values from upstream html_url and browser_download_url fields. Those values feed user-facing Open in Gitea, notification, issue, pull, review, comment, and attachment links. A malformed upstream response can therefore present a trusted dashboard action that navigates away from the configured forge.

Scope

  • Apply the existing configured-origin/base-path URL boundary to every user-facing Gitea resource URL.
  • Preserve valid absolute and relative links under GITEA_URL, including fragments.
  • Reject cross-origin, scheme-downgraded, and same-origin/outside-base-path links.
  • Cover search, notifications, work details, issue/pull mutations, comments, attachments, dependencies, and reviews.

Acceptance tests

  1. Cross-origin and HTTP downgrade URLs are omitted/rejected in normalized API results.
  2. Same-origin URLs under the configured Gitea subpath remain navigable; relative URLs canonicalize correctly.
  3. Same-origin URLs outside the configured subpath are rejected.
  4. Focused URL-boundary tests and the full suite pass.

Audit found no matching title among 538 historical issues, no open PR, and no recent commit implementing this origin boundary.

## Problem Dashboard API normalization accepts arbitrary absolute HTTP(S) values from upstream `html_url` and `browser_download_url` fields. Those values feed user-facing Open in Gitea, notification, issue, pull, review, comment, and attachment links. A malformed upstream response can therefore present a trusted dashboard action that navigates away from the configured forge. ## Scope - Apply the existing configured-origin/base-path URL boundary to every user-facing Gitea resource URL. - Preserve valid absolute and relative links under `GITEA_URL`, including fragments. - Reject cross-origin, scheme-downgraded, and same-origin/outside-base-path links. - Cover search, notifications, work details, issue/pull mutations, comments, attachments, dependencies, and reviews. ## Acceptance tests 1. Cross-origin and HTTP downgrade URLs are omitted/rejected in normalized API results. 2. Same-origin URLs under the configured Gitea subpath remain navigable; relative URLs canonicalize correctly. 3. Same-origin URLs outside the configured subpath are rejected. 4. Focused URL-boundary tests and the full suite pass. Audit found no matching title among 538 historical issues, no open PR, and no recent commit implementing this origin boundary.
timmy was assigned by rockachopa 2026-08-18 08:49:52 +00:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels   
P0

Drop everything

  
P1

High priority

  
P2

Medium priority

  
agent:nightprowl

Assignments routed to the LongCat NightProwl evaluation worker

  
backend

Backend service

  
ci

Continuous integration / actions

  
frontend

Frontend / UI

  
meta

Meta / planning

  
pages

Gitea Pages

  
template

Repo template / standards

No Label
P0
P1
P2
agent:nightprowl
backend
ci
frontend
meta
pages
template
Milestone
Clear milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
No Assignees
timmy
1 Participants
Notifications
Due Date
The due date is invalid or out of range. Please use the format 'yyyy-mm-dd'.

No due date set.

Dependencies

No dependencies set.

Reference: stackchain/stackchain-dashboard#1072
No description provided.
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?