Username ending with `.keys` is problematic

1. GitLab exposes the public keys of people under <domain>/<user>.keys. For example: https://gitlab.com/leipert.keys
2. A username can end in .keys
3. If both exist, the public keys of the of the user without .keys take precendence.

For example:

1. We have the user @joernchen
2. We have the user @joernchen.keys
3. https://gitlab.com/joernchen.keys shows the public keys of @joernchen instead of the profile @joernchen.keys

This is somewhat related to #350273

marked this issue as related to #350273

Also related to: #26295 (closed)

marked this issue as related to #26295 (closed)

@jarka / @hsutor Is this ~"group::authentication and authorization" or more ~"group::workspace", @mksionek / @lohrc?

@leipert ~"group::authentication and authorization" , I've updated the label

mentioned in issue #350273

@leipert I'm marking this confidential as it looks like the exact same problem as #26295 (closed) which we considered to be a security issue. @gitlab-com/gl-security/appsec Do you think this is a bugvulnerability?

This doesn't appear to be a vulnerability from the standpoint of public key exposure. Pubkeys are meant to be public.

I'd call this more of a bug than a vulnerability as security doesn't appear to be degraded by this feature.

Thanks for validating! Making this issue public once again.

made the issue confidential

Related: on #350273 (comment 954482896) I've proposed that we remove . as an allowed character in usernames.

changed milestone to %Backlog

added groupauthentication and authorization [DEPRECATED] label

Setting label(s) devopsmanage sectiondev based on ~"group::authentication and authorization".

added devopsmanage sectiondev labels

added [deprecated] Accepting merge requests label

, please can you add a type label to this issue to help with issue discovery in issue reports.

---

(improve this comment?)

added auto updated label

made the issue visible to everyone

added typebug label

removed [deprecated] Accepting merge requests label

added Seeking community contributions label

@leipert thanks for adding the Seeking community contributions label!

This issue's description does not seem to have a section for "Implementation Guide". Please consider adding one, because it makes a big difference for contributors. This section can be brief but must have clear technical guidance, like:

• Hints on lines of code which may need changing
• Hints on similar code/patterns that can be leveraged
• Suggestions for test coverage
• Ideas for breaking up the merge requests into iterative chunks

This message was generated automatically. You're welcome to improve it.

removed Seeking community contributions label

added vintage label

Hi @leipert ,

Thanks for raising this bug.

Contributions like this are vital to help make GitLab a better product.

We would be grateful for your help in verifying whether your bug report requires further attention from the team. If you think this bug still exists, and is reproducible with the latest stable version of GitLab, please comment on this issue.

This issue has been inactive for more than 12 months now and based on the policy for inactive bugs, will be closed in 7 days.

Thanks for your contributions to make GitLab better!

added stale label

removed stale label

Still reproducible: https://gitlab.com/joernchen.keys

added devopsgovern sectionsec labels and removed devopsmanage sectiondev labels

added groupauthentication label and removed groupauthentication and authorization [DEPRECATED] label

mentioned in merge request !139269 (merged)

Hi @leipert ,

Thanks for raising this bug.

Contributions like this are vital to help make GitLab a better product.

We would be grateful for your help in verifying whether your bug report requires further attention from the team. If you think this bug still exists, and is reproducible with the latest stable version of GitLab, please comment on this issue.

This issue has been inactive for more than 12 months now and based on the policy for inactive bugs, will be closed in 7 days.

Thanks for your contributions to make GitLab better!

Still reproducible: https://gitlab.com/joernchen.keys

added stale label

removed stale label

added Category:System Access label