Internal Server Error while using `Content-Type=multipart/form-data; boundary=cats` on `/v1/user/keys`

[ludovicianul]

Description

Description

While doing some fuzzing using https://github.com/Endava/cats I discovered an issue for the /v1/user/keys" endpoint. Doing a POST with multipart/form-data; boundary=cats Content-Type results in a 500, rather that something more meaningful.

You can reproduce the issue using (just replace $token with your own token):

cats replay Test1246.json

Test1246.json.zip

Gitea Version

1.17.0+dev-573-ge45738e3c

Can you reproduce the bug on the Gitea demo site?

Yes

Log Gist

No response

Screenshots

No response

Git Version

No response

Operating System

No response

How are you running Gitea?

Onlinehttps://try.gitea.io/

Database

No response

[zeripath]

Would it be possible to see some logs for this?

[wxiaoguang]

It could be reproduced by:

curl -v -XPOST -H "Authorization: token $token" -H "Content-Type: multipart/form-data; boundary=cats" "https://try.gitea.io/api/v1/user/keys"

[wxiaoguang]

panic here:

[zeripath]

PR to prevent the NPE in binding https://gitea.com/go-chi/binding/pulls/13