vole

Clone

Read only, no credentials:

https://rodent.software/git/vole.git

Write over SSH with a registered key:

git clone ssh://git@0.0.0.0:2222/vole.git

A free and open-source forge that lives in your Git repo.

Harden sign-in input bounds and private response caching

25343521418945b250da2fb29d27cffe34ee2a6e · Keenan Nemetz · 3d ago · parent b492b557

Harden sign-in input bounds and private response caching

Bound the account name in LoginBegin before it reaches the per-account rate
limiter or the ceremony store, and bound the passkey label and the credential
fields copied from an authenticator. Rate-limit keys are capped by hashing a
long value, forwarding headers used as addresses are capped, and expired limiter
entries are swept as the table grows.

Mark downloads and rendered pages private unless the repository is readable
anonymously. A private repository's artifact, archive, run artifact, raw file,
and HTML pages previously either carried a public cache directive or no
directive at all, so a shared cache could serve them to an anonymous reader.

Refs #209 (01M6S78Y7EQY596Y9TQRSNRVSE).
Refs #210 (01M6S7936QAYM9TMSCXCYP2CF9).

server/web/ratelimit_test.go +47

@@ -0,0 +1,47 @@
	1	package web
	2
	3	import (
	4	"net/http/httptest"
	5	"strings"
	6	"testing"
	7	"time"
	8
	9	"github.com/rodent-software/vole/forge/config"
	10	)
	11
	12	// TestRateLimitKeysAreBounded: a client-supplied string can be long, but the
	13	// table must not grow by that length. A short key stays readable; a long one is
	14	// hashed to a fixed size.
	15	func TestRateLimitKeysAreBounded(t *testing.T) {
	16	t.Parallel()
	17	l := newRateLimiter(1, time.Minute)
	18	if ok, _ := l.allow("login:" + strings.Repeat("a", 1<<20)); !ok {
	19	t.Fatal("the first attempt was refused")
	20	}
	21	if len(l.m) != 1 {
	22	t.Fatalf("table has %d keys, want 1", len(l.m))
	23	}
	24	for key := range l.m {
	25	if len(key) > maxRateKeyBytes {
	26	t.Fatalf("stored key is %d bytes, limit %d", len(key), maxRateKeyBytes)
	27	}
	28	if !strings.HasPrefix(key, "sha256:") {
	29	t.Fatalf("a long key was not hashed: %q", key)
	30	}
	31	}
	32	if got := rateKey("short"); got != "short" {
	33	t.Fatalf("rateKey(short) = %q, want the key unchanged", got)
	34	}
	35	}
	36
	37	// TestClientAddressIsBounded: a forwarding header is used as a rate-limit key
	38	// and in a log line, so its length is capped even when the proxy trusts it.
	39	func TestClientAddressIsBounded(t *testing.T) {
	40	t.Parallel()
	41	w := &Web{Cfg: &config.Config{GitHTTPClientIPHeader: "X-Forwarded-For"}}
	42	r := httptest.NewRequest("POST", "/auth/login/begin", nil)
	43	r.Header.Set("X-Forwarded-For", strings.Repeat("a", 1<<20))
	44	if got := w.clientAddress(r); len(got) > maxClientAddressBytes {
	45	t.Fatalf("client address is %d bytes, limit %d", len(got), maxClientAddressBytes)
	46	}
	47	}