Re:Gitea: Open source, self-hosted GitHub alternative
by kakwa_ on Sunday May 06, 2018 @03:10PM
(#17007840)
I'm wondering if Gitea is a little better than Gogs in term of security.
I remember that Debian considered Gogs to replace Alioth, but rejected it because of security concerns like injections (SQL XSS, etc).
I've also seen Gogs REST API behave badly when we tried to migrate/create a few hundred repositories using said API. Some of the repositories had special characters in their names, and the REST API accepted them without warnings. And after that the instance was pretty much unusable.
It was a while ago, but at the time, it seems that Gogs didn't do much input sanitization.
I remember that Debian considered Gogs to replace Alioth, but rejected it because of security concerns like injections (SQL XSS, etc).
I've also seen Gogs REST API behave badly when we tried to migrate/create a few hundred repositories using said API. Some of the repositories had special characters in their names, and the REST API accepted them without warnings. And after that the instance was pretty much unusable.
It was a while ago, but at the time, it seems that Gogs didn't do much input sanitization.