Sign in

Search issue titles and bodies, change requests and comments. Private repositories you cannot read are not included.
vole
Clone

Read only, no credentials:

https://rodent.software/git/vole.git

Write over SSH with a registered key:

git clone ssh://git@0.0.0.0:2222/vole.git

A free and open-source forge that lives in your Git repo.

#12

P1: Harden web transport, URL generation, and CSP

closed · opened by keenan 13d ago

keenan opened this 13d ago

Why

  • cloneBase / lfsObjectBase derive public URLs from Host and X-Forwarded-Proto; prefer configured public_url or emit relative URLs, and validate trusted proxy headers.
  • The CSP still allows inline styles; some security headers are missing.
  • Plain-tar archive concurrency is unbounded while gzip is bounded.
  • Code search, compare/merge-tree, blame, and history have no request timeouts or semaphores.
  • The UI builds http://<repo>.<pages_domain> links even when the forge is HTTPS.

Scope

  • Use configured public_url (or relative URLs) for clone/LFS/artifact links.
  • Add Permissions-Policy, Cross-Origin-Opener-Policy, Cross-Origin-Resource-Policy, and object-src 'none'.
  • Remove style-src 'unsafe-inline' if feasible.
  • Consider an Origin/Referer check in addition to the CSRF token.
  • Bound plain-tar archive concurrency.
  • Add timeouts/semaphores to search, compare, blame, and history.
  • Serve site links over HTTPS when the forge is HTTPS.
  • Document same-site risk if pages_domain shares a registrable domain with the forge.

Acceptance

  • Host-header injection does not change generated download/clone URLs.
  • Archive/search endpoints have bounded concurrency and timeouts.

Comments (0)

No comments yet.