Matrix webhook doesn't send access token in Authorization header on replay

[jellykells]

Description

If a Matrix webhook fails and it is replayed, the access token is not sent in the Authorization header. The resulting header sent is Authorization: Bearer

Gitea Version

1.16.8

Can you reproduce the bug on the Gitea demo site?

No

Log Gist

https://gist.github.com/jellykells/68fdaba33b2a68c2a3edec59a34b5b40

Screenshots

No response

Git Version

2.17.1

Operating System

Linux 4.15.0

How are you running Gitea?

Binary downloaded from GitHub and run with systemd

Database

MySQL

[oliverpool]

From a quick analysis, here is what I think happens:

• the original (insecure) payload is generated, with the access_token and saved as HookTask

• on first try, the HookTask is fetch from the database and the access_token is taken from the payload and the payload is replaced with a safe payload (without the token):
  https://github.com/go-gitea/gitea/blob/release/v1.17/services/webhook/matrix.go#L267-L277

• after every try the HookTask is saved
  https://github.com/go-gitea/gitea/blob/release/v1.17/services/webhook/deliver.go#L158

• hence on retry, the payload does not contain the token anymore

There is a PR to better manage such Authorization header, which should fix this: #20267 (the PR is initially aimed only for gitea webhooks, but I hope that it will be reconsidered :)

[oliverpool]

FYI, the PR should be included in the 1.19 release (in a couple of months).