Documentation
¶
Index ¶
Constants ¶
This section is empty.
Variables ¶
var ( // ErrUnsupportedRemoteScheme is returned when a git remote uses a scheme // that is neither a supported network transport nor safe to hand to the // git subprocess (e.g. file://, ext::, or a bare local path). ErrUnsupportedRemoteScheme = errors.New("remote scheme is not allowed") // ErrAmbiguousHost is returned when a remote host is neither a canonical // IP literal nor a valid DNS name. Non-canonical IPv4 literals such as // "0177.0.0.1" land here: Go reads them as one address and libcurl reads // them as another, so they can never be validated safely. ErrAmbiguousHost = errors.New("remote host is not a canonical IP or DNS name") )
var ( // ErrPrivateIP is returned when a connection to a private or internal IP is blocked. ErrPrivateIP = errors.New("connection to private or internal IP address is not allowed") // ErrInvalidScheme is returned when a URL scheme is not http or https. ErrInvalidScheme = errors.New("URL must use http or https scheme") // ErrInvalidURL is returned when a URL is invalid. ErrInvalidURL = errors.New("invalid URL") )
Functions ¶
func GitEnv ¶ added in v0.12.0
func GitEnv(remotes ...ValidatedGitRemote) []string
GitEnv renders the environment that must be passed to any git subprocess touching the given validated remotes.
Validation alone is not sufficient for a subprocess: git resolves hostnames again itself, and follows the first HTTP redirect by default. Both walk straight through a validate-then-exec check, so this environment disables redirects and pins each validated address. Callers MUST apply it to every git command that touches the remote, or the validation means nothing.
func NewSecureClient ¶
NewSecureClient returns an HTTP client with SSRF protection. It validates resolved IPs at dial time to block connections to private and internal networks. Hostnames are resolved and the validated IP is used directly in the dial call to prevent DNS rebinding (TOCTOU between validation and connection). Redirects are disabled to match the webhook client convention and prevent redirect-based SSRF.
func ValidateIPBeforeDial ¶
ValidateIPBeforeDial validates an IP address before establishing a connection. This prevents DNS rebinding attacks by checking the resolved IP at dial time.
func ValidateURL ¶
ValidateURL validates that a URL is safe to make requests to. It checks that the scheme is http/https, the hostname is not localhost, and all resolved IPs are public.
Types ¶
type GitConfigEntry ¶ added in v0.12.0
GitConfigEntry is a single git configuration key/value pair.
type GitRemoteTransport ¶ added in v0.12.0
type GitRemoteTransport int
GitRemoteTransport describes how a validated remote will be reached.
const ( // GitTransportHTTP is an http/https remote. These are validated and // pinned to the resolved IP. GitTransportHTTP GitRemoteTransport = iota // GitTransportGit is a git:// remote. These are validated but cannot be // pinned, since the git protocol dials directly rather than via libcurl. GitTransportGit // GitTransportSSH is an ssh remote. Reachability is governed by the // operator's SSH client key, so these are not IP-validated. GitTransportSSH )
type ValidatedGitRemote ¶ added in v0.12.0
type ValidatedGitRemote struct {
// Transport is the transport the remote will use.
Transport GitRemoteTransport
// Config holds per-remote git configuration required for the validation
// to hold, such as pinning a hostname to the address that was validated.
// Render it with GitEnv, which also applies the settings that are needed
// regardless of remote.
Config []GitConfigEntry
}
ValidatedGitRemote is the result of validating a git remote URL.
func ValidateGitRemote ¶ added in v0.12.0
func ValidateGitRemote(remote string) (ValidatedGitRemote, error)
ValidateGitRemote validates a git remote URL against private, internal, and loopback address ranges.
The result must be passed to GitEnv, and that environment applied to every git subprocess touching the remote. Validation on its own does not survive contact with git, which re-resolves hostnames and follows redirects.
SSH remotes are allowed without IP validation: they authenticate with the operator's own client key rather than anything an importing user controls.
Source Files