Repository navigation
fix: keep the GitHub token out of build containers, lock down node edges - #1
Merged
Merged
Conversation
…e edges - buildpipe/heal: the gh token was embedded in the remote URL, which git writes to .git/config inside the workspace that is bind-mounted into the build container (and the heal checkout the agent works in). It now goes to git as an http.extraheader for github.com via GIT_CONFIG_* env vars. - edge: never forward a visitor's x-openpages-target. reqwest appends, the node reads the first value, so any visitor could pick the local port on a node to proxy to. - node edge: require x-openpages-node-key (sha256 of the node secret, which the panel already stores) so the 0.0.0.0:8789 listener is not an open proxy to the node's localhost. - api: a node may only post logs/results for a deployment queued for it and still building; before, any node token could mark a local deployment ready with artifact_path=/ or an arbitrary container_port. - edge/buildpipe: refuse symlinks that leave the deployment when serving, and refuse a symlinked or escaping output directory when placing it. - webhook: only refs/heads/* deploys; refs/heads/fix/main no longer counts as a push to main, tags no longer count as branches.
|
Important
This repository does not receive automatic reviews because it has fewer than 10 stars.
 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes the Critical and High findings, plus two related Medium ones, from the 2026-11-07 audit.
buildpipe.rs:110-112put thegh auth tokeninto theoriginURL, and git writes that URL to.git/configin the workspace.runtime.rs:122then bind-mounts that workspace read-write at/workspace, so any build step or npm postinstall script couldcat /workspace/.git/config.docs/ARCHITECTURE.md:113claimed the opposite.http.https://github.com/.extraheaderthroughGIT_CONFIG_COUNT/KEY/VALUEenvironment variables. It is no longer in the URL or in argv, and nothing is written to disk. Same change inheal.rs, where the agent works in the clone.edge::proxycopied every request header, including the visitor's ownx-openpages-target, then appended the panel's spec. reqwest appends rather than replaces, and the node reads the first value, socurl -H 'x-openpages-target: container:6379' https://site.examplewas proxied to any localhost port on the node.x-openpages-targetandx-openpages-node-keyfrom forwarded headers.0.0.0.0:8789) has no authentication, so it was an open proxy to the node's localhost for anyone who can reach it.x-openpages-node-key(thetoken_hashit already stores), and the node compares it in constant time against sha256 of its own secret. Upgrade the panel and nodes together.node_result/node_logsdidn't check that the deployment belonged to the calling node. A node could mark a local deployment ready withartifact_path: "/", which serves the panel host's filesystem, or with anycontainer_port.claimed_by()requiresdeployment.node_id == node.id. Results are only accepted while the deployment isbuilding.pick_fileusedis_file()/fs::read, which follow links, soln -s ~/.config/gh/hosts.yml dist/xfrom the repo or an install script published host files. A symlinked output or root dir madeplace()rename a directory from anywhere on the host.branch = git_ref.rsplit('/'), so a push torefs/heads/fix/maindeployed to production, and tags counted as branches.refs/heads/*is accepted, with the prefix stripped.Verification
cargo fmt --check,cargo clippy --all-targets -- -D warningsandcargo test(103 pass, 5 new) all pass locally.a_visitor_cannot_choose_the_node_target(a real proxy round-trip against a stand-in node),symlinks_out_of_the_deployment_are_not_served,a_symlinked_or_escaping_output_directory_is_refused,only_the_hash_of_our_own_secret_opens_the_edge,auth_env_carries_the_token_as_a_github_scoped_header. I reverted the two edge fixes and confirmed their tests fail: the node receivedcontainer:6379,static:blog/1, and the symlinked file was served with 200..git/.Not changed:
update.rs:264still clones openpages' own source with the token in the URL (Low; the code is trusted). Remote nodes still receive the owner's full gh token in each job (Medium, design; see the audit report).