Repository: go-gitea/gitea
File: routers/web/repo/githttp.go (Go)

Code before:
	fs := gitrepo.GetRepoFS(h.getStorageRepo())
	ctx.Resp.Header().Set("Content-Type", contentType)
	http.ServeFileFS(ctx.Resp, ctx.Req, fs, path.Clean(file))
}

// one or more key=value pairs separated by colons
var safeGitProtocolHeader = regexp.MustCompile(`^[0-9a-zA-Z]+=[0-9a-zA-Z]+(:[0-9a-zA-Z]+=[0-9a-zA-Z]+)*$`)

func prepareGitCmdWithAllowedService(service string) (*gitcmd.Command, error) {
	if service == ServiceTypeReceivePack {
		return gitcmd.NewCommand(ServiceTypeReceivePack), nil
	}
	if service == ServiceTypeUploadPack {
		return gitcmd.NewCommand(ServiceTypeUploadPack), nil
	}
	if service == ServiceTypeUploadArchive {
		return gitcmd.NewCommand(ServiceTypeUploadArchive), nil
	}
	return nil, fmt.Errorf("service %q is not allowed", service)
}

func serviceRPC(ctx *context.Context, h *serviceHandler, service string) {
	defer func() {
		if err := ctx.Req.Body.Close(); err != nil {
			log.Error("serviceRPC: Close: %v", err)
		}
	}()

	expectedContentType := fmt.Sprintf("application/x-git-%s-request", service)
	if ctx.Req.Header.Get("Content-Type") != expectedContentType {
		log.Error("Content-Type (%q) doesn't match expected: %q", ctx.Req.Header.Get("Content-Type"), expectedContentType)
		// FIXME: why it's 401 if the content type is unexpected?
		ctx.Resp.WriteHeader(http.StatusUnauthorized)
		return
	}

	cmd, err := prepareGitCmdWithAllowedService(service)
	if err != nil {
		log.Error("Failed to prepareGitCmdWithService: %v", err)
		// FIXME: why it's 401 if the service type doesn't supported?
		ctx.Resp.WriteHeader(http.StatusUnauthorized)
		return
	}

	ctx.Resp.Header().Set("Content-Type", fmt.Sprintf("application/x-git-%s-result", service))

	reqBody := ctx.Req.Body

	// Handle GZIP.
	if ctx.Req.Header.Get("Content-Encoding") == "gzip" {
		reqBody, err = gzip.NewReader(reqBody)

Review comment (suggestion):
If you changed the behavior, does here it also supports `archive`?

<img width="2154" height="728" alt="image" src="https://github.com/user-attachments/assets/4f4b8efb-6e72-4f6d-8e20-6a9a6b858bd9" />


Code after:
		ctx.Resp.WriteHeader(http.StatusBadRequest)
		return
	}

	fs := gitrepo.GetRepoFS(h.getStorageRepo())
	ctx.Resp.Header().Set("Content-Type", contentType)
	http.ServeFileFS(ctx.Resp, ctx.Req, fs, path.Clean(file))
}

// one or more key=value pairs separated by colons
var safeGitProtocolHeader = regexp.MustCompile(`^[0-9a-zA-Z]+=[0-9a-zA-Z]+(:[0-9a-zA-Z]+=[0-9a-zA-Z]+)*$`)

func prepareGitCmdWithAllowedService(service string, allowedServices []string) *gitcmd.Command {
	if !slices.Contains(allowedServices, service) {
		return nil
	}
	switch service {
	case ServiceTypeReceivePack:
		return gitcmd.NewCommand(ServiceTypeReceivePack)
	case ServiceTypeUploadPack:
		return gitcmd.NewCommand(ServiceTypeUploadPack)
	case ServiceTypeUploadArchive:
		return gitcmd.NewCommand(ServiceTypeUploadArchive)
	default:
		return nil
	}
}

func serviceRPC(ctx *context.Context, service string) {
	defer ctx.Req.Body.Close()
	h := httpBase(ctx, "git-"+service)
	if h == nil {
		return
	}

	expectedContentType := fmt.Sprintf("application/x-git-%s-request", service)
	if ctx.Req.Header.Get("Content-Type") != expectedContentType {
		log.Debug("Content-Type (%q) doesn't match expected: %q", ctx.Req.Header.Get("Content-Type"), expectedContentType)
		ctx.Resp.WriteHeader(http.StatusBadRequest)
		return
	}

	cmd := prepareGitCmdWithAllowedService(service, []string{ServiceTypeUploadPack, ServiceTypeReceivePack, ServiceTypeUploadArchive})
	if cmd == nil {
		ctx.Resp.WriteHeader(http.StatusBadRequest)
		return
	}
	// git upload-archive does not have a "--stateless-rpc" option
	if service == ServiceTypeUploadPack || service == ServiceTypeReceivePack {
		cmd.AddArguments("--stateless-rpc")
	}