Aphuongkma

Authenticated attackers with `allow run as` enabled can cause a denial of service by exhausting CPU resources. This occurs when arbitrarily deeply nested JSON structures are submitted to the 'POST /security/user/authenticate/run as' endpoint. By repeatedly sending malformed `auth context` bodies with unlimited nesting depth, the API framework consumes excessive CPU, denying service to other API consumers.

The `ToHook()` function in `services/webhook/general.go` decrypts the `HeaderAuthorizationEncrypted` field and returns the plaintext authorization header in the API response. This allows repository administrators to read sensitive credentials, such as Bearer tokens, Basic auth credentials, and API keys, set by other administrators. The issue occurs because the function decrypts the secret stored in the database using the server's `SecretKey` before serializing it into the response, effectively converting a write-only secret into a readable credential.