Sign in

Search issue titles and bodies, change requests and comments. Private repositories you cannot read are not included.
vole
Clone

Read only, no credentials:

https://rodent.software/vole.git

Write over SSH with a registered key:

git clone ssh://git@rodent.software:2222/vole.git

A free and open-source forge that lives in your Git repo.

#4

P0: Harden Git HTTP and HTTP server limits

closed · opened by keenan 13d ago

keenan opened this 13d ago

Why

server/githttp/githttp.go accepts POST upload-pack bodies with no positive body cap; only negative Content-Length is refused. The git http-backend subprocess has no request context or timeout and can outlive a disconnected client. rest/PATH_INFO is only split, not validated for dot segments. server/server.go has no ReadTimeout, WriteTimeout, or MaxHeaderBytes.

Scope

  • Reject request bodies over a small cap and require a known Content-Length on POST.
  • Validate rest against the known smart-HTTP endpoints and reject ./../NUL segments.
  • Tie git http-backend to r.Context(); kill and drain on client disconnect.
  • Add a clone concurrency semaphore and per-IP limit.
  • Configure ReadTimeout, MaxHeaderBytes, and bounded per-route timeouts.
  • Add slowloris, oversized-body, and disconnect tests.

Acceptance

  • Oversized or malformed Git HTTP requests fail closed.
  • A disconnected clone leaves no git http-backend process behind.
  • Concurrent clone load keeps memory and process counts bounded.

Comments (0)

No comments yet.