s3.use_ssl is documented as defaulting to true but the code defaults to plain HTTP #158

New Issue

2026-09-22T00:55:14+02:00

clawbot commented

2026-09-22 00:55:14 +02:00

Found by the security review #73. Severity: medium.

What is wrong

With the s3.* form of configuration (no storage_url), an s3.endpoint written without a scheme, and use_ssl omitted, storerFromLegacyS3Config builds an http:// endpoint (internal/storage/module.go:115-121). S3Config.UseSSL is a plain bool (internal/config/config.go:165) and Load applies no default. config.example.yml:284-286 says Default: true.

An endpoint written with a scheme ignores use_ssl, and the documented examples carry one, so the exposed case is a scheme-less endpoint. The s3:// URL form already defaults to TLS (internal/storage/url.go:78).

Separately, the config init template lists use_ssl under the credentials block for s3:// URLs (internal/cli/config.go:195), where the key is never read: TLS there is turned off only by ?ssl=false in the URL.

Why it matters

Blob contents stay age-encrypted, but over plain HTTP a network observer sees what the store operator sees (manifests, object names, sizes, the access key id) and can alter responses.

Acceptable

For the s3.* form, TLS is the default: plain HTTP only when use_ssl: false is written explicitly or the endpoint starts with http://.
The config init template drops the use_ssl line from the s3:// block or documents ?ssl=false instead.
config.example.yml matches the code.

Definition of done

Test: s3.* form, scheme-less endpoint, use_ssl omitted, yields an https:// endpoint; explicit use_ssl: false yields http://.
No existing assertion weakened; make check green.

Line numbers are as of next at 6fcd8e1.

model: fable-5-1

Found by the security review https://git.eeqj.de/sneak/vaultik/issues/73. Severity: **medium**. ## What is wrong With the `s3.*` form of configuration (no `storage_url`), an `s3.endpoint` written without a scheme, and `use_ssl` omitted, `storerFromLegacyS3Config` builds an `http://` endpoint (`internal/storage/module.go:115-121`). `S3Config.UseSSL` is a plain bool (`internal/config/config.go:165`) and `Load` applies no default. `config.example.yml:284-286` says `Default: true`. An endpoint written with a scheme ignores `use_ssl`, and the documented examples carry one, so the exposed case is a scheme-less endpoint. The `s3://` URL form already defaults to TLS (`internal/storage/url.go:78`). Separately, the `config init` template lists `use_ssl` under the credentials block for `s3://` URLs (`internal/cli/config.go:195`), where the key is never read: TLS there is turned off only by `?ssl=false` in the URL. ## Why it matters Blob contents stay age-encrypted, but over plain HTTP a network observer sees what the store operator sees (manifests, object names, sizes, the access key id) and can alter responses. ## Acceptable - For the `s3.*` form, TLS is the default: plain HTTP only when `use_ssl: false` is written explicitly or the endpoint starts with `http://`. - The `config init` template drops the `use_ssl` line from the `s3://` block or documents `?ssl=false` instead. - `config.example.yml` matches the code. ## Definition of done 1. Test: `s3.*` form, scheme-less endpoint, `use_ssl` omitted, yields an `https://` endpoint; explicit `use_ssl: false` yields `http://`. 2. No existing assertion weakened; `make check` green. Line numbers are as of `next` at `6fcd8e1`. model: fable-5-1

clawbot referenced this issue from a commit

2026-09-22 10:37:54 +02:00

Default a scheme-less s3.* endpoint to TLS (closes #158)

clawbot referenced a pull request that will close this issue

2026-09-22 10:38:02 +02:00

Default a scheme-less s3.* endpoint to TLS #178

clawbot commented

2026-09-22 10:38:18 +02:00

Fixed in #178.

S3Config.UseSSL is now *bool: omitted means the default (TLS), so a scheme-less s3.endpoint resolves to https:// unless use_ssl: false is written explicitly; an endpoint that already carries a scheme is unchanged. This matches the s3:// URL form. config.example.yml becomes accurate without editing it. The config init template no longer lists use_ssl in the s3:// block (never read there) and points at ?ssl=false instead.

Test added: a legacy s3.* config with a scheme-less endpoint resolves to https when use_ssl is omitted and http when it is false. make check green.

Model: opus-4-8

Fixed in https://git.eeqj.de/sneak/vaultik/pulls/178. `S3Config.UseSSL` is now `*bool`: omitted means the default (TLS), so a scheme-less `s3.endpoint` resolves to `https://` unless `use_ssl: false` is written explicitly; an endpoint that already carries a scheme is unchanged. This matches the `s3://` URL form. `config.example.yml` becomes accurate without editing it. The `config init` template no longer lists `use_ssl` in the `s3://` block (never read there) and points at `?ssl=false` instead. Test added: a legacy `s3.*` config with a scheme-less endpoint resolves to `https` when `use_ssl` is omitted and `http` when it is `false`. `make check` green. Model: opus-4-8

clawbot referenced this issue from a commit

2026-09-22 11:04:36 +02:00

Default a scheme-less s3.* endpoint to TLS (closes #158)

clawbot closed this issue

2026-09-22 11:11:34 +02:00

clawbot referenced this issue from a commit

2026-09-22 11:11:36 +02:00

Default a scheme-less s3.* endpoint to TLS (closes #158)

clawbot referenced this issue

2026-09-22 11:48:32 +02:00

next: accumulated work for the upcoming release #114

Sign in to join this conversation.