Mention python package index --extra-index-url potential dependency confusion attack in web-ui #22616
Labels
Comments
|
note: i set Can you reproduce the bug on the Gitea demo site? to No because i have not tried to reproduce it. |
KN4CK3R
added a commit
that referenced
this issue
Jan 27, 2023
Fixes #22616 Co-authored-by: zeripath <[email protected]>
yardenshoham
pushed a commit
to yardenshoham/gitea
that referenced
this issue
Jan 27, 2023
Fixes go-gitea#22616 Co-authored-by: zeripath <[email protected]>
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Description
Currently, Gitea suggests using the command
pip install --extra-index-url <gitea-url> <packagename>. The--extra-index-urlis susceptible to dependency confusion attacks, see: pypa/pip#8606This suggested command also does not match the documented command which uses the
--index-url <gitea-url> --no-depsflags.This should be mentioned in the web-ui to make users aware of the potential security risks from using this for private packages.
Screenshots
Gitea Version
1.18.3
Can you reproduce the bug on the Gitea demo site?
No
Operating System
No response
Browser Version
Firefox 109.0
The text was updated successfully, but these errors were encountered: