From 679efbdd26930a3586cd34cf19f570396544e62f Mon Sep 17 00:00:00 2001
From: zeripath <art27@cantab.net>
Date: Wed, 11 Nov 2020 20:34:16 +0000
Subject: [PATCH] Disallow urlencoded new lines in git protocol paths if there
 is a port (#13521)

Signed-off-by: Andrew Thornton <art27@cantab.net>
---
 modules/auth/repo_form.go | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/modules/auth/repo_form.go b/modules/auth/repo_form.go
index 6c3421e4f7d85..c51adadba1328 100644
--- a/modules/auth/repo_form.go
+++ b/modules/auth/repo_form.go
@@ -97,6 +97,9 @@ func (f MigrateRepoForm) ParseRemoteAddr(user *models.User) (string, error) {
 			u.User = url.UserPassword(f.AuthUsername, f.AuthPassword)
 		}
 		remoteAddr = u.String()
+		if u.Scheme == "git" && u.Port() != "" && (strings.Contains(remoteAddr, "%0d") || strings.Contains(remoteAddr, "%0a")) {
+			return "", models.ErrInvalidCloneAddr{IsURLError: true}
+		}
 	} else if !user.CanImportLocal() {
 		return "", models.ErrInvalidCloneAddr{IsPermissionDenied: true}
 	} else if !com.IsDir(remoteAddr) {