Webhooks with HTTP method GET place the entire payload in the URL query string

[Otto-Deviant1904]

Description

When a webhook is configured with HTTP method GET (selectable in the webhook settings UI for the Gitea/GoGS hook types), delivery puts the full JSON payload into the URL query string:

services/webhook/deliver.go, newDefaultRequest:

case http.MethodGet:
    vals["payload"] = []string{t.PayloadContent}
    u.RawQuery = vals.Encode()

Problems

1. URL length limits. Payloads for push events etc. easily exceed typical URL length limits (8 KB server limits, ~2 KB practical proxy limits). Deliveries then fail with 414 or connection errors, and the task is marked failed with no actionable message.
2. Payload leakage into logs. The entire payload (issue content, usernames, commit messages) ends up in query strings, which are commonly logged by reverse proxies and access logs — unlike POST bodies.

Suggested directions

• Warn when creating/saving a GET webhook that payloads are delivered via query string.
• Optionally cap the payload query parameter for GET deliveries and surface a clear error in the delivery history when failure occurs.

[Otto-Deviant1904]

I have a working fix for this locally (early size check in newDefaultRequest with a clear error message, plus a unit test) and would be happy to put up a PR. Could I be assigned to this one?

[bircni]

@Otto-Deviant1904 feel free to open a pr