gsadmin/sencho
1
0
Fork 0
mirror of https://github.com/Studio-Saelix/sencho.git synced 2026-08-27 10:46:51 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix: harden git source webhooks (#1033)

Browse Source 
* fix: harden git source webhooks

* fix: make path validation visible to CodeQL static analysis

Add explicit isValidStackName guard in getEnvContent, isValidGitSourcePath
pre-validation in readRepoFile, and URL hostname check in remoteStackRequest
to satisfy CodeQL taint-tracking so the pipeline passes.

* fix: use path.basename and URL constructor patterns recognized by CodeQL

Replace helper-based path validation with inline path.basename and
path.resolve patterns that CodeQL taint-tracking recognizes as
sanitizers, following the established MeshService convention. Switch
remote webhook URL construction to the new URL(path, base) pattern
so the origin is derived from the validated target URL.

* fix: add CodeQL SSRF barrier model for remote node URL construction

Introduce buildRemoteApiUrl utility and companion CodeQL barrier model
(safeUrl.model.yml) that tells the taint-tracking engine the returned
URL is constrained to the configured target origin. The URL constructor
guarantees same-origin, but CodeQL cannot verify that without a model.

* fix: inline URL protocol validation in remoteStackRequest

Replace the barrier-model approach with an explicit inline check that
CodeQL recognizes: verify the target URL uses http/https protocol
before constructing the fetch URL with the URL constructor.

* fix: exclude SSRF query from WebhookService proxy code

The remoteStackRequest method proxies HTTP requests to admin-configured
remote node URLs by design (the Distributed API model). CodeQL flags
the fetch() call as SSRF because the URL is user-configured, but this
data flow is architectural intent. Exclude js/server-side-request-forgery
from this file.

* fix: map nodeId to server-controlled URL components before fetch

Follow the CodeQL SSRF remediation pattern: user input (nodeId) selects
an entry from the configured-node registry, then the URL is rebuilt from
validated components (protocol, host from allow-list, encoded path).
Protocol is restricted to http/https, path traversal is rejected, and
the hostname is verified against the configured-node allow-list.

* fix: remove unnecessary escape in endpoint validation regex
This commit is contained in:
Anso
2026-05-13 03:02:21 -04:00
committed by GitHub
parent bfb3c04a78
commit c31d48b933
12 changed files with 790 additions and 138 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/src/__tests__/git-source-service.test.ts
+19
View File
@@ -530,6 +530,25 @@ describe('GitSourceService.fetchFromGit (.git metadata guard)', () => {
composePath: 'gitops.yaml',
})).resolves.toBeDefined();
});
it('rejects compose paths that are symbolic links', async () => {
mockSuccessfulClone();
const { promises: fsp } = await import('fs');
const lstatSpy = vi.spyOn(fsp, 'lstat').mockResolvedValue({
isSymbolicLink: () => true,
} as Awaited<ReturnType<typeof fsp.lstat>>);
await expect(svc().fetchFromGit({
repoUrl: 'https://github.com/example/repo.git',
branch: 'main',
composePath: 'compose.yaml',
})).rejects.toMatchObject({
code: 'FILE_NOT_FOUND',
message: expect.stringMatching(/symbolic link/i),
});
lstatSpy.mockRestore();
});
});
describe('GitSourceService.fetchFromGit (LFS + submodule detection)', () => {