GHSA-fgxm-5hvv-x4vh: charmbracelet/soft-serve HTTP responses disclose the existence and names of private repositories

Soft Serve answers Go’s ?go-get=1 requests by walking up the requested path until it finds a repository, then rendering that repository’s name and clone URL into a go-import meta tag. The walk checked that each candidate repository existed, but never that the caller could read it.

A request for a path inside a private repository, such as GET /secret/anything?go-get=1, therefore returned 200 naming secret and its clone URL, even though GET /secret?go-get=1 correctly returned 404. The same ?go-get=1 exception in the HTTP access middleware also let requests reach the LFS and dumb-HTTP routes with the repository existence check skipped, where two LFS handlers dereferenced the missing repository and panicked.

The same disclosure appears without ?go-get=1. The Git and LFS routes answered a repository the caller could not read differently depending on whether it existed: an anonymous clone of a private repository got 401 while a missing one got 404, and a signed-in user without access got the reverse pattern. Either way, one request confirms whether a guessed name is a private repository. This was found while fixing the go-get issue and is included here because it has the same impact and is fixed in the same release.