Skip to content

fix(gitea): fail closed when webhook secret is unset - #4

Closed
utsab345 wants to merge 238 commits into
mainfrom
fix/gitea-webhook-fail-closed-3640
Closed

fix(gitea): fail closed when webhook secret is unset#4
utsab345 wants to merge 238 commits into
mainfrom
fix/gitea-webhook-fail-closed-3640

Conversation

@utsab345

@utsab345 utsab345 commented Sep 23, 2026

Copy link
Copy Markdown
Owner

Description

Fixes a fail-open webhook authentication bug in the Gitea server.

The Gitea webhook handler only verified signature authenticity when GITEA.WEBHOOK_SECRET was configured. Since the shipped default leaves it empty, every deployment that skipped the secret accepted forged webhook events. Any internet caller could post fake issue_comment or pull_request events (for example a comment body of /review with an arbitrary pull_request.url) and trigger expensive AI commands against PRs the bot token can read, without it ever coming from Gitea.

The other providers already fail closed:

  • GitHub rejects webhooks with HTTP 403 when the secret is unset.
  • GitLab rejects with HTTP 401 when no shared secret or token is present.
    Gitea was the open outlier.

Change

  • Reject every Gitea webhook with HTTP 403 when GITEA.WEBHOOK_SECRET is not configured, matching the GitHub app behavior.
  • Document the secret as required in the Gitea installation guide and in .secrets_template.toml.

Testing

  • New unit test: test_unconfigured_secret_rejects_every_webhook verifies an unauthenticated request is refused with 403, no command is dispatched, and no background task is scheduled.
  • Existing signature tests still pass (valid sign, missing header 400, bad signature 401).
  • tests/unittest/test_gitea_comment_webhooks.py, test_webhook_logic_core.py, test_should_process_pr_logic_shared.py, and test_pr_command_profiles.py all green.

shashankvarma499 and others added 30 commits September 8, 2026 13:39
@shashankvarma499
docs: fix automations note to reflect self-hosted deployments (The-PR…
4d9829d 
…-Agent#3201)

Signed-off-by: Shashank Varma <324153016+shashankvarma499@users.noreply.github.com>
@asarakhatun17-lgtm
chore: remove dead bandit configuration (The-PR-Agent#3203)
349d106
@utsab345 Utsab
TYP: ship a py.typed marker for PEP 561 compliance (The-PR-Agent#3205)
b11a1db 
Co-authored-by: Utsab <utsab@pr-agent.dev>
@PeterDaveHello
chore(deps): update yanked Python dependencies (The-PR-Agent#3211)
11c1442
@utsab345 Utsab
ci: run the pre-commit workflow on pull requests (The-PR-Agent#3212)
5e41d97 
Co-authored-by: Utsab <utsab@pr-agent.dev>
@Shaisolaris
docs: drop stale README release entries (The-PR-Agent#3208)
f7656a9
@PeterDaveHello
chore: pin uv 0.12.10 in pyproject.toml (The-PR-Agent#3153)
1dcd346
@auroraxo Aurora
test(providers): enforce capability predicate truth (The-PR-Agent#3156)
29709d4 
Co-authored-by: Aurora <aurora9c69543e@atomicmail.ai>
@PeterDaveHello
fix(polling): bound active workers across polling iterations (The-PR-…
6f2e0ff 
…Agent#3063)
@oleksii-tumanov
fix(describe): retain successful chunks after partial failure (The-PR…
d9395ee 
…-Agent#3163)

Co-authored-by: Alex Tumanov <6143578+oleksii-tumanov@users.noreply.github.com>
@7487 @claude
fix(deps): declare certifi as a range per the security-pin policy (Th…
bf05b46 
…e-PR-Agent#3204)

Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
@7487 @claude
refactor(help): select help rendering by provider capability (The-PR-…
172d261 
…Agent#3213)

Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
@auroraxo Aurora
fix(providers): report code-suggestion publication failure (The-PR-Ag…
00b8c9d 
…ent#3219)

Co-authored-by: Aurora <aurora9c69543e@atomicmail.ai>
@junnhwan
fix(bitbucket): restore persistent comment links (The-PR-Agent#3226)
d5c15c4 
Signed-off-by: hwan <3373484735@qq.com>
@junnhwan
fix(review): preserve findings after failed chunks (The-PR-Agent#3229)
a648424 
Signed-off-by: hwan <3373484735@qq.com>
@yashaskn8
fix(github): report total inline suggestion fallback failure (The-PR-…
8bd1532 
…Agent#3232)
@PeterDaveHello
Harden Dockerfiles for stable and predictable builds (The-PR-Agent#3218)
70d3f27
@PeterDaveHello
fix(release): keep uv.lock in sync with version bumps (The-PR-Agent#3214
aaa2992 
)
@auroraxo Aurora
refactor: select PR chat link by provider capability (The-PR-Agent#3239)
17651f7 
Co-authored-by: Aurora <aurora9c69543e@atomicmail.ai>
@PeterDaveHello
ci: verify uv.lock freshness (The-PR-Agent#3245)
5307248
@PeterDaveHello
perf(gitlab): avoid redundant project fetches for file reads (The-PR-…
1f1abd1 
…Agent#3247)
@utsab345
refactor: remove 14 dead functions in the tool layer (The-PR-Agent#3182…
539d0b8 
…) (The-PR-Agent#3236)
@utsab345
docs: add a documentation page for the MOSAICO A2A server (The-PR-Age…
2296abb 
…nt#3234)
@even-even
chore: optimize list(x.values) -> x.to_list() pandas (The-PR-Agent#3233)
3abfc84 
Co-authored-by: even-even <>
@utsab345
chore(github): upgrade PyGithub to 2.x and migrate off deprecated aut…
847dcbb 
…h classes (The-PR-Agent#3240)
@utsab345 Utsab
docs: add a complete configuration reference covering every option (T…
5bf8b40 
…he-PR-Agent#3217)

Co-authored-by: Utsab <utsab@pr-agent.dev>
@Mihailchik
test(docs): guard mkdocs and GitBook navs against drift (The-PR-Agent…
db06a90 
…#3231)

Co-authored-by: mihailchkik <Mihailchik@users.noreply.github.com>
@PeterDaveHello @IsmaelMartinez @claude
docs: correct stale and inaccurate documentation and comments (The-PR…
cb4177c 
…-Agent#3250)

Co-authored-by: Ismael Martinez Ramos <ismaelmartinez@gmail.com>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
@macjayz @IsmaelMartinez @claude
docs: remove stale best practices guidance (The-PR-Agent#3202)
b2d3dde 
Co-authored-by: Ismael Martinez Ramos <ismaelmartinez@gmail.com>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
@utsab345 Utsab
@IsmaelMartinez @claude
fix(similar_issue): port pinecone backend to the current SDK (The-PR-…
6e13fa6 
…Agent#3227)

Co-authored-by: Utsab <utsab@pr-agent.dev>
Co-authored-by: Ismael Martinez Ramos <ismaelmartinez@gmail.com>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
PeterDaveHello and others added 27 commits September 20, 2026 22:02
@PeterDaveHello
perf(gitea): skip unused head content fetches (The-PR-Agent#3569)
f3db692
@PeterDaveHello
test(gitea): cover signed comment webhook dispatch (The-PR-Agent#3575)
8356f2a
@PeterDaveHello
fix(polling): log worker capacity waits (The-PR-Agent#3574)
1ab1029
@PeterDaveHello
fix(codecommit): apply ignore rules and read .pr_agent.toml from the …
c2a37e6 
…destination commit (The-PR-Agent#3576)
@PeterDaveHello
fix(diff): preserve source lines containing EOF marker text (The-PR-A…
553d111 
…gent#3572)
@even-even @IsmaelMartinez
chore: fix E501 ruff rule part1 (The-PR-Agent#3517)
91abbb7 
Co-authored-by: vyuroshchin <>
Co-authored-by: IsmaelMartinez <ISMAELMARTINEZ@GMAIL.COM>
@azhar22k
refactor(algo): extract run reporting to run_output (3/3) (The-PR-Age…
8a578ef 
…nt#3511) (The-PR-Agent#3522)
@utsab345 @IsmaelMartinez @claude
fix: point shipped docs links at live targets (The-PR-Agent#3556)
9b94b0e 
Co-authored-by: Ismael Martinez Ramos <ismaelmartinez@gmail.com>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
@utsab345
fix(github): send label names to the set-labels endpoint (The-PR-Agen…
84ed39e 
…t#3582)
@high-tail
test(litellm_openrouter_controls): fixed broken ut which now is suppo… (
ecc91bb 
The-PR-Agent#3584)
@oleksii-tumanov
fix: preserve quoting in CLI and configured Action commands (The-PR-A…
b9fed67 
…gent#3585)

Co-authored-by: Alex Tumanov <6143578+oleksii-tumanov@users.noreply.github.com>
@utsab345
fix: check pinecone upsert response (The-PR-Agent#3561)
1d01f24
@github-actions
chore(release): bump version to 0.46.0 [skip ci]
e50017e
@PeterDaveHello
chore(ci): align native test checkout action with v7.0.1 (The-PR-Agen…
c782819 
…t#3593)
@PeterDaveHello
perf(diff): use set membership when packing remaining files (The-PR-A…
53f599a 
…gent#3591)
@PeterDaveHello
perf(context): optimize markdown fence selection (The-PR-Agent#3592)
e3bf5c8
@PeterDaveHello
fix(tokens): count special-token literals as ordinary text (The-PR-Ag…
16e5ea2 
…ent#3573)
@PeterDaveHello
fix(bitbucket): preserve backslashes in rendered suggestions (The-PR-…
5968fc3 
…Agent#3577)
@utsab345
fix(review): keep findings with non-numeric line fields (The-PR-Agent…
cc6f2b8 
…#3590)
@sajjadlabx @IsmaelMartinez
fix(qdrant): batch similar issue uploads (The-PR-Agent#3559)
5c626b5 
Co-authored-by: IsmaelMartinez <ISMAELMARTINEZ@GMAIL.COM>
@oleksii-tumanov
fix(mosaico): classify diff files by language (The-PR-Agent#3597)
eb9e0c2 
Co-authored-by: Oleksii Tumanov <oleksii-tumanov@users.noreply.github.com>
@oleksii-tumanov
fix: preserve backslashes in diagram markers (The-PR-Agent#3599)
4ac48b2 
Co-authored-by: Alex Tumanov <6143578+oleksii-tumanov@users.noreply.github.com>
@oleksii-tumanov
fix: keep changelog wait cooperative (The-PR-Agent#3601)
560c9f2
@high-tail
refactor(cloud_auth): deduplicate repeated logic (The-PR-Agent#3607)
9d7b5c7
@dependabot
chore(ci): bump the actions-minor-and-patch group with 6 updates (The…
7957d33 
…-PR-Agent#3594)

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@utsab345
fix(action): ignore non-command comments (The-PR-Agent#3604)
223ac51
@utsab345
fix(gitea): fail closed when webhook secret is unset
dfa6db8
@github-actions github-actions Bot added the bug Something isn't working label Sep 23, 2026
@utsab345

utsab345 commented Sep 23, 2026

Copy link
Copy Markdown
Owner Author

Closed: created against the fork instead of the upstream repo

@utsab345 utsab345 closed this Sep 23, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

bug Something isn't working

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.