sneak/upaas
1
0
Fork 0
Code Issues 9 Pull Requests 1 Actions 1 Packages Projects Releases 1 Wiki Activity

fix: restrict SCP-like URLs to git user only and reject path traversal

Browse Source 
- Changed SCP regex to only accept 'git' as the username
- Added path traversal check: reject URLs containing '..'
- Added test cases for non-git users and path traversal
This commit is contained in:
clawbot
2026-02-19 20:17:25 -08:00
committed by user
parent a2fb42520d
commit a2087f4898
2 changed files with 12 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
internal/handlers/repo_url_validation_test.go
View File

@@ -32,6 +32,11 @@ func TestValidateRepoURL(t *testing.T) {
{name: "no host https", url: "https:///path", wantErr: true},
{name: "no path https", url: "https://github.com", wantErr: true},
{name: "no path https trailing slash", url: "https://github.com/", wantErr: true},
{name: "SCP-like non-git user", url: "root@github.com:user/repo.git", wantErr: true},
{name: "SCP-like arbitrary user", url: "admin@github.com:user/repo.git", wantErr: true},
{name: "path traversal SCP", url: "git@github.com:../../etc/passwd", wantErr: true},
{name: "path traversal https", url: "https://github.com/user/../../../etc/passwd", wantErr: true},
{name: "path traversal in middle", url: "https://github.com/user/repo/../secret", wantErr: true},
}
for _, tc := range tests {