A partner reported a bug in our self-hosted GitLab. They typed a made-up address into the “Forgot your
password?” form at git.zupermicro.com, and GitLab cheerfully replied that if the address was
registered, a reset link was on its way. No email arrived, because the address was made up. They wanted to know why
GitLab lies.
It is not lying. It is declining to answer a question you did not realize you were asking.
If the form said “No account with that address” for addresses that do not exist and “Reset sent” for addresses that do, then the form would be a free directory of everyone who has an account. Type in a list of plausible addresses, and the ones that come back “Reset sent” are your targets. Security people call this user enumeration. Everyone else calls it “the form being helpful.”
So the form gives the same answer no matter what. This is a case where being unhelpful is the feature. It is the same reason the receptionist answers “I can neither confirm nor deny that this person is a patient here” when somebody calls asking whether their ex is in the emergency room.
Now, an attentive reader will point out that our blog lists the names of our authors, and the authors’ user names follow a predictable pattern, so the enumeration is available anyway, just not through this form. That reader is correct, and I invite them to send a finding to the same change advisory board as everything else.
Bonus chatter: Older GitLab versions had a bug where the reset form accepted a list of email addresses and sent the reset link to all of them. We are told our version is not affected. We are told this by the same person who scheduled the change advisory board.