golem15/summercms
4
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(34): WR-03 refuse user info in https git URLs

Browse Source 
validateGitURL refused only a password, but GitHub, GitLab and Gitea take
a token as the user part of an https URL. Such a URL was printed and
written to .gitmodules by git submodule add, and so committed with the
application. An https URL with any user info is now refused with a hint
to use a credential helper; the user of an ssh URL stays allowed.
This commit is contained in:
Jakub Zych
2026-10-29 22:09:39 +01:00
parent 9977e31ac9
commit 2f3eba0cb1
3 changed files with 12 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
internal/build/install_smoke_test.go
View File

@@ -576,6 +576,9 @@ func TestInstallSmoke(t *testing.T) {
"http://git.example.com/acme/blog.git",
"git://git.example.com/acme/blog.git",
"https://user:secret@git.example.com/acme/blog.git",
"https://ghp_token@github.com/acme/blog.git",
"https://oauth2@git.example.com/acme/blog.git",
"ssh://git:secret@git.example.com/acme/blog.git",
"https://git.example.com/-x",
"git@git.example.com:-oProxyCommand=x",
"https://git.example.com/a b.git",

9
internal/build/source.go
View File

@@ -78,7 +78,8 @@ func isGitURL(arg string) bool {
// validateGitURL accepts https://, ssh:// and scp-like user@host:path
// addresses (file:// only when cliGitProtocols allows it, in tests). It
// refuses a leading "-", transport::address forms, http, credentials in
// the URL and control characters.
// the URL (any user info in an https URL, a password in any URL) and
// control characters.
func validateGitURL(raw string) error {
switch {
case raw == "":
@@ -117,6 +118,12 @@ func validateGitURL(raw string) error {
if _, hasPassword := u.User.Password(); hasPassword {
return fmt.Errorf("git URL must not carry a password; use a git credential helper")
}
// GitHub, GitLab and Gitea take a token as the user part of an https
// URL; it would be printed and written to .gitmodules (WR-03). The
// user of an ssh URL is not a secret.
if scheme == "https" && u.User != nil {
return fmt.Errorf("an https git URL must not carry user info (a token in the user part ends up in .gitmodules); use a git credential helper")
}
if strings.HasPrefix(u.Path, "/-") || u.Path == "" || u.Path == "/" {
return fmt.Errorf("git URL %q has an invalid path", raw)
}