Hare/yoi
1
1
Fork 0
Code Actions Packages Releases Activity

fix: reject plain HTTP repository sources

Browse Source
This commit is contained in:
Hare
2026-09-13 01:12:01 +09:00
parent eefdef1bef 2d512b6be6
commit d97c40d6af
10 changed files with 270 additions and 57 deletions
Download Patch File Download Diff File Expand all files Collapse all files
crates/worker-runtime/src/working_directory.rs
+81 -26
View File
@@ -52,8 +52,6 @@ pub struct WorkingDirectoryEvidence {
pub credential_revision: Option<u64>,
#[serde(default, skip_serializing_if = "Option::is_none")]
pub host_trust_revision: Option<u64>,
#[serde(default, skip_serializing_if = "Option::is_none")]
pub transport_warning: Option<String>,
}
#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
@@ -856,6 +854,18 @@ impl RuntimeGitMaterializer {
Ok(binding)
}
fn validate_plain_http_source(
request: &WorkingDirectoryRequest,
) -> Result<(), WorkingDirectoryDiagnostic> {
if url::Url::parse(&request.repository.source.uri).is_ok_and(|url| url.scheme() == "http") {
return Err(WorkingDirectoryDiagnostic::new(
"working_directory_repository_plain_http_unsupported",
"plain HTTP Repository sources are not executable; register an HTTPS or SSH source instead",
));
}
Ok(())
}
fn validate_request(
request: &WorkingDirectoryRequest,
) -> Result<(), WorkingDirectoryDiagnostic> {
@@ -871,11 +881,10 @@ impl RuntimeGitMaterializer {
"the configured Repository provider is unsupported",
));
}
Self::validate_plain_http_source(request)?;
if matches!(
request.repository.source.kind,
workspace_api::RepositorySourceKind::Https
| workspace_api::RepositorySourceKind::Http
| workspace_api::RepositorySourceKind::Ssh
workspace_api::RepositorySourceKind::Https | workspace_api::RepositorySourceKind::Ssh
) {
validate_remote_source_uri(request)?;
let materialization = request.materialization.as_ref().ok_or_else(|| {
@@ -899,8 +908,7 @@ impl RuntimeGitMaterializer {
match request.repository.source.kind {
workspace_api::RepositorySourceKind::LocalPath
| workspace_api::RepositorySourceKind::File
| workspace_api::RepositorySourceKind::Https
| workspace_api::RepositorySourceKind::Http => {}
| workspace_api::RepositorySourceKind::Https => {}
workspace_api::RepositorySourceKind::Ssh => {
let ssh = request
.materialization
@@ -984,6 +992,7 @@ impl RuntimeGitMaterializer {
request: &WorkingDirectoryRequest,
) -> Result<WorkingDirectoryBinding, WorkingDirectoryDiagnostic> {
validate_working_directory_id(&working_directory_id)?;
Self::validate_plain_http_source(request)?;
let request =
self.request_with_authorized_repository_access(&working_directory_id, request)?;
Self::validate_request(&request)?;
@@ -1085,8 +1094,6 @@ impl RuntimeGitMaterializer {
host_trust_revision: context
.and_then(|value| value.ssh.as_ref())
.map(|value| value.host_trust_revision),
transport_warning: repository_transport_warning(request.repository.source.kind)
.map(str::to_string),
},
cleanup_target: WorkingDirectoryCleanupTarget {
kind: "runtime_git_clone".to_string(),
@@ -2393,10 +2400,6 @@ fn validate_ssh_materialization_access(
Ok(())
}
fn repository_transport_warning(kind: workspace_api::RepositorySourceKind) -> Option<&'static str> {
(kind == workspace_api::RepositorySourceKind::Http).then_some("plain_http_transport")
}
fn validate_remote_source_uri(
request: &WorkingDirectoryRequest,
) -> Result<(), WorkingDirectoryDiagnostic> {
@@ -2438,12 +2441,10 @@ fn validate_remote_source_uri(
"remote Repository source URI is invalid",
)
})?;
let expected_scheme = match request.repository.source.kind {
workspace_api::RepositorySourceKind::Https => "https",
workspace_api::RepositorySourceKind::Http => "http",
_ => return Ok(()),
};
if url.scheme() != expected_scheme
if request.repository.source.kind != workspace_api::RepositorySourceKind::Https {
return Ok(());
}
if url.scheme() != "https"
|| url.host_str().is_none()
|| url.password().is_some()
|| url.query().is_some()
@@ -2576,10 +2577,23 @@ fn read_bounded_command_output(mut reader: impl Read) -> Vec<u8> {
captured
}
#[cfg(test)]
thread_local! {
static TEST_REPOSITORY_GIT_INVOCATIONS: std::cell::Cell<usize> = const { std::cell::Cell::new(0) };
}
#[cfg(test)]
fn test_repository_git_invocation_count() -> usize {
TEST_REPOSITORY_GIT_INVOCATIONS.with(std::cell::Cell::get)
}
fn run_repository_git_stdout(
mut command: Command,
source_kind: workspace_api::RepositorySourceKind,
) -> Result<String, WorkingDirectoryDiagnostic> {
#[cfg(test)]
TEST_REPOSITORY_GIT_INVOCATIONS.with(|count| count.set(count.get().saturating_add(1)));
command
.stdin(Stdio::null())
.stdout(Stdio::piped())
@@ -2670,6 +2684,9 @@ fn run_repository_git(
mut command: Command,
code: &'static str,
) -> Result<(), WorkingDirectoryDiagnostic> {
#[cfg(test)]
TEST_REPOSITORY_GIT_INVOCATIONS.with(|count| count.set(count.get().saturating_add(1)));
tracing::info!(
target: "yoi::repository_access",
event = "repository_git_operation_started",
@@ -4291,16 +4308,54 @@ mod tests {
);
let mut http = request(repo.path());
http.repository.source = workspace_api::RepositorySource {
kind: workspace_api::RepositorySourceKind::Http,
uri: "http://example.test/repo.git".to_string(),
};
http.repository.source = serde_json::from_value(serde_json::json!({
"kind": "http",
"uri": "http://example.test/repo.git",
}))
.unwrap();
http.materialization = Some(context(None));
RuntimeGitMaterializer::validate_request(&http).unwrap();
let git_invocations_before = test_repository_git_invocation_count();
let error = materializer
.materialize(&worker_ref(3), &http)
.expect_err("historical plain HTTP source must fail before Git execution");
assert_eq!(
repository_transport_warning(http.repository.source.kind),
Some("plain_http_transport")
error.code,
"working_directory_repository_plain_http_unsupported"
);
assert!(error.message.contains("HTTPS or SSH"));
assert_eq!(
test_repository_git_invocation_count(),
git_invocations_before,
"plain HTTP rejection must occur before invoking Git"
);
for (offset, kind) in [
workspace_api::RepositorySourceKind::LocalPath,
workspace_api::RepositorySourceKind::File,
workspace_api::RepositorySourceKind::Https,
]
.into_iter()
.enumerate()
{
let mut mismatched_http = request(repo.path());
mismatched_http.repository.source = workspace_api::RepositorySource {
kind,
uri: "http://example.test/repo.git".to_string(),
};
let git_invocations_before = test_repository_git_invocation_count();
let error = materializer
.materialize(&worker_ref(4 + offset as u64), &mismatched_http)
.expect_err("plain HTTP URI must fail regardless of its declared source kind");
assert_eq!(
error.code,
"working_directory_repository_plain_http_unsupported"
);
assert_eq!(
test_repository_git_invocation_count(),
git_invocations_before,
"mismatched plain HTTP source must fail before invoking Git"
);
}
let mut ssh = request(repo.path());
ssh.repository.source = workspace_api::RepositorySource {