Limit release asset redirects

internal/gitea/assets.go

@@ -56,6 +56,7 @@ func (c Client) openAsset(ctx context.Context, client *http.Client, base *url.UR
 	}
 	assetURL.Fragment = ""
 	visited := make(map[string]struct{})
+	followed := 0
 	for {
 		key := assetURL.String()
 		if _, exists := visited[key]; exists {
@@ -75,6 +76,10 @@ func (c Client) openAsset(ctx context.Context, client *http.Client, base *url.UR
 			return nil, failure(FailureUnverifiable, "download release asset", 0, err)
 		}
 		if isRedirect(response.StatusCode) {
+			if followed == 10 {
+				_ = response.Body.Close()
+				return nil, failure(FailureUnverifiable, "redirect release asset: redirect limit exceeded", response.StatusCode, errors.New("at most 10 redirects are allowed"))
+			}
 			location, locationErr := response.Location()
 			_ = response.Body.Close()
 			if locationErr != nil || location.User != nil {
@@ -82,6 +87,7 @@ func (c Client) openAsset(ctx context.Context, client *http.Client, base *url.UR
 			}
 			location.Fragment = ""
 			assetURL = location
+			followed++
 			continue
 		}
 		if response.StatusCode < 200 || response.StatusCode >= 300 {