[Bug] 500 on accessing stripped-parameter URL

[OdinVex]

Description

Attempting to access https://demo.gitea.com/user/oauth2/Gitea.Com/callback results in a 500.

On a side note it was unintentional access, my browser extension stripped parameters.

Screenshots

500

Gitea Version

1.24.0+dev-460-gdcbf6c2d13

Can you reproduce the bug on the Gitea demo site?

Yes

Operating System

No response

Browser Version

LibreWolf

[wxiaoguang]

What browser extension you are using? The proper callback URL is like this, and it is valid URL.

By the way, some bad requests indeed would cause 500 error, it is a known and trivial problem because normal users won't be affected.

[OdinVex]

I know my browser extension stripped it, I mentioned that, but a 500 usually means unable to handle an exception. I use many add-ons (including a few that would strip), but in this case it was "cleaned" up by CleanLinks (modified variant of my own to deobfuscate Bing URLs in particular). I'd offer the thought of redirecting to the login page (usually suggestive of "check your extensions" when that happens), maybe with an indicative message.

[wxiaoguang]

By the way, some bad requests indeed would cause 500 error, it is a known and trivial problem because normal users won't be affected.

Yep, I agree that other error messages could be better. However that's a longstanding problem, a lot of old code was written that way, so it needs time and manpower to clean up them one by one ......

[wxiaoguang]

For this 500 error, we can do this: Improve oauth2 error handling #33969

[OdinVex]

Looks great. :)