open/llm-security
1
0
Fork 0
Code Issues Releases 6 Activity

fix(git-clone): accept HTTPS repo URLs on any host, not just GitHub

Browse source 
scanners/lib/git-clone.mjs accepted only github.com, so the README's
Forgejo example (and /security scan on any Forgejo, Codeberg or self-hosted
URL) failed validation; scan.md and plugin-audit.md also routed only
https://github.com/ to the clone path.

Chose generic HTTPS over adding one host to an allowlist because there is
no documented security reason for the host check. Read before choosing:
git log --follow (import + E12 only), the file's comments, CHANGELOG v2.4.0
("GitHub repo URL support", feature framing), security-hardening-guide §2
and §7 (the sandbox is the defence against filter/smudge drivers), and
review-2026-06-20, which lists "vsix-fetch (HTTPS host allowlist)" as a
protection but no host check for git-clone. What protects a clone is the
OS sandbox, GIT_SANDBOX_CONFIG and GIT_SANDBOX_ENV, for every host alike.

Measured: with GIT_SANDBOX_ENV, git reads 0 config lines outside a repo;
without it, osxkeychain comes from Xcode's system gitconfig. So no stored
credential is offered to an unknown host.

The shape stays strict: https only, no userinfo, host starts and ends
alphanumeric (no leading -), optional port, exactly owner/repo, no query
or fragment. SSH stays GitHub-only: ssh uses the user's own keys and
~/.ssh/config, which the git environment does not isolate.

Tests (red first): Forgejo and any-host accept 2 failing -> green; guards
for http, userinfo, leading -, extra path, query, ext:: and file:: and
non-GitHub SSH hold. The old "rejects non-GitHub URL" case still passes
(it has no owner/repo) and is renamed to say so. Regex timed linear
(< 1 ms at 200k chars). Live: a sandboxed clone of
https://git.fromaitochitta.com/open/llm-security.git exits 0 at 5208420,
cleaned up.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
Kjell Tore Guttormsen 2026-09-22 14:14:39 +02:00
commit 35359b7d8c
Signed by: ktg
SSH key fingerprint: SHA256:JakMjO6FTBBzN0Bhfj9saOoEjaFxlSdYuZQQpM/lF9Q
4 changed files with 48 additions and 11 deletions
Download patch file Download diff file Expand all files Collapse all files

21
scanners/lib/git-clone.mjs
View file

@ -1,21 +1,30 @@
#!/usr/bin/env node
// git-clone.mjs — Clone GitHub repos to temp dirs for security scanning
// git-clone.mjs — Clone remote git repos to temp dirs for security scanning
// Usage:
// node git-clone.mjs clone <url> [--branch <name>] → sandboxed shallow clone, prints tmpdir path
// node git-clone.mjs cleanup <dir> → removes temp directory
// node git-clone.mjs validate <url> → exits 0 if valid GitHub URL, 1 if not
// node git-clone.mjs validate <url> → exits 0 if valid repo URL, 1 if not
import { mkdtempSync, rmSync, existsSync, realpathSync, readFileSync } from 'node:fs';
import { join } from 'node:path';
import { tmpdir } from 'node:os';
import { spawnSync } from 'node:child_process';
const GITHUB_URL_RE = /^https:\/\/github\.com\/[\w.-]+\/[\w.-]+(\.git)?\/?$/;
// HTTPS on any host (v8.1.0). The GitHub-only host check was feature scope, not
// a boundary: what protects the scan is the OS sandbox, GIT_SANDBOX_CONFIG and
// GIT_SANDBOX_ENV, and they apply to every host alike. GIT_CONFIG_NOSYSTEM and
// GIT_CONFIG_GLOBAL=/dev/null also drop credential helpers, so no stored
// credential is offered to an unknown host. The shape stays strict: https only,
// no userinfo, a host that starts and ends alphanumeric (no leading `-`), an
// optional port, exactly owner/repo, no query or fragment.
// SSH stays GitHub-only: ssh uses the user's own keys and ~/.ssh/config, which
// the git environment does not isolate.
const HTTPS_REPO_URL_RE = /^https:\/\/[A-Za-z0-9](?:[A-Za-z0-9.-]*[A-Za-z0-9])?(?::\d{1,5})?\/[\w.-]+\/[\w.-]+(\.git)?\/?$/;
const GITHUB_SSH_RE = /^git@github\.com:[\w.-]+\/[\w.-]+(\.git)?$/;
const MAX_CLONE_SIZE_MB = 100;
function isValidUrl(url) {
return GITHUB_URL_RE.test(url) || GITHUB_SSH_RE.test(url);
return HTTPS_REPO_URL_RE.test(url) || GITHUB_SSH_RE.test(url);
}
function parseArgs(argv) {
@ -185,8 +194,8 @@ switch (command) {
}
if (!isValidUrl(url)) {
console.error(`clone: invalid GitHub URL: ${url}`);
console.error('Supported: https://github.com/user/repo or git@github.com:user/repo.git');
console.error(`clone: invalid repository URL: ${url}`);
console.error('Supported: https://<host>/<owner>/<repo>[.git] or git@github.com:<owner>/<repo>.git');
process.exit(1);
}