feat: update gitea vendor

package/gitea/source/routers/web/goget.go

@@ -11,10 +11,14 @@ import (
 	"path"
 	"strings"
 
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/util"
-	"code.gitea.io/gitea/services/context"
+	auth_model "gitea.dev/models/auth"
+	access_model "gitea.dev/models/perm/access"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unit"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/util"
+	"gitea.dev/services/context"
 )
 
 func goGet(ctx *context.Context) {
@@ -51,10 +55,8 @@ func goGet(ctx *context.Context) {
 		return
 	}
 	branchName := setting.Repository.DefaultBranch
-
-	repo, err := repo_model.GetRepositoryByOwnerAndName(ctx, ownerName, repoName)
-	if err == nil && len(repo.DefaultBranch) > 0 {
-		branchName = repo.DefaultBranch
+	if repo, err := repo_model.GetRepositoryByOwnerAndName(ctx, ownerName, repoName); err == nil {
+		branchName = goGetDefaultBranch(ctx, repo)
 	}
 	prefix := setting.AppURL + path.Join(url.PathEscape(ownerName), url.PathEscape(repoName), "src", "branch", util.PathEscapeSegments(branchName))
 
@@ -91,3 +93,47 @@ func goGet(ctx *context.Context) {
 	ctx.RespHeader().Set("Content-Type", "text/html")
 	_, _ = ctx.Write([]byte(res))
 }
+
+// goGetDefaultBranch returns the repository's real default branch only when the caller may genuinely
+// reach it, otherwise the neutral instance default, so the meta response does not disclose the branch
+// name (or the repo's existence) to callers who cannot see the repository.
+func goGetDefaultBranch(ctx *context.Context, repo *repo_model.Repository) string {
+	def := setting.Repository.DefaultBranch
+	if len(repo.DefaultBranch) == 0 {
+		return def
+	}
+	if err := repo.LoadOwner(ctx); err != nil || repo.Owner == nil {
+		return def
+	}
+	// a token that was not granted repository read scope must not learn repository details, even when the
+	// account behind it could read the repo through the web UI
+	if !goGetTokenCanReadRepo(ctx) {
+		return def
+	}
+	// a public-only token may only reach genuinely public resources (a public repo under a public owner)
+	if context.TokenIsPublicOnly(ctx) && (repo.IsPrivate || !repo.Owner.Visibility.IsPublic()) {
+		return def
+	}
+	// the caller must be able to read the code and see the owner: a limited/private owner hides its repos
+	// from anonymous/non-member callers even when the repo itself is public
+	perm, err := access_model.GetDoerRepoPermission(ctx, repo, ctx.Doer)
+	if err != nil || !perm.CanRead(unit.TypeCode) || !user_model.IsUserVisibleToViewer(ctx, repo.Owner, ctx.Doer) {
+		return def
+	}
+	return repo.DefaultBranch
+}
+
+// goGetTokenCanReadRepo reports whether the request may learn repository details. A non-token request
+// always may; a token request may only when its scope grants repository read, so a PAT that was never
+// scoped for repositories cannot disclose the branch even if its owner can read the repo.
+func goGetTokenCanReadRepo(ctx *context.Context) bool {
+	if ctx.Data["IsApiToken"] != true {
+		return true
+	}
+	scope, ok := ctx.Data["ApiTokenScope"].(auth_model.AccessTokenScope)
+	if !ok {
+		return false
+	}
+	has, err := scope.HasScope(auth_model.AccessTokenScopeReadRepository)
+	return err == nil && has
+}