Affected: Gitea Open Source Git Server

SSRF via Migration Asset Downloads Bypasses hostmatcher — Reads Internal Files and Cloud Metadata

Affected: Go: code.gitea.io/gitea, Go: gitea.dev

### Summary

Gitea has robust SSRF protection via `hostmatcher.NewDialContext()` for webhook and migration clone URLs, which validates resolved IPs at the TCP dial level. However, three code paths use raw `http.Get()` (Go's `DefaultClient`) which completely bypasses this protection, enabling SSRF to internal services and local file read via the `file://` scheme.

### Vulnerable Code

**File: `modules/uri/uri.go` (line 32) -- Core vulnerability**

```go func Open(uriStr string) (io.ReadCloser, error) { u, err := url.Parse(uriStr) switch strings.ToLower(u.Scheme) { case "http", "https": f, err := http.Get(uriStr) // RAW http.Get -- no hostmatcher filtering return f.Body, nil case "file": return os.Open(u.Path) // LOCAL FILE READ via file:// scheme } } ```

**Callers in migration path:** - `services/migrations/gitea_uploader.go:340` -- `uri.Open(*asset.DownloadURL)` for release assets - `services/migrations/gitea_uploader.go:586` -- `uri.Open(pr.PatchURL)` for PR patches

**File: `services/migrations/dump.go` (lines 312, 453)**

```go // Line 312 -- release asset download resp, err := http.Get(*asset.DownloadURL)

// Line 453 -- PR patch download (with self-documenting TODO) resp, err := http.Get(u) // TODO: This probably needs to use the downloader ```

**File: `routers/web/auth/oauth.go` (line 306)**

```go func oauth2UpdateAvatarIfNeed(ctx *context.Context, url string, u *user_model.User) { resp, err := http.Get(url)…