GITGUD

neiam neiam /gitgud

Git Gud

public · Issues · Pulls · Labels · Forks · Compare · Actions success · Badges · Packages

⭐ 1

Log in to mark this repository.

3.3 KiB · text History b868907

Input Validation & Sanitization

Implemented Controls

SSRF Prevention

lib/git_gud/outbound_url.ex — Comprehensive outbound URL validation

Blocks the following categories of URLs when making outbound HTTP requests:

  • Loopback addresses: 127.0.0.0/8, ::1, localhost
  • Link-local: 169.254.0.0/16
  • Private ranges: RFC 1918 (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16)
  • Cloud metadata: 169.254.169.254 (AWS, GCP, Azure metadata endpoints)
  • IPv6 unique-local: fc00::/7
  • IPv6 multicast: ff00::/8
  • IPv6 reserved: ::/128, ::1/128
  • IPv4-mapped IPv6: ::ffff:0:0/96
  • CGNAT: 100.64.0.0/10

DNS rebinding protection included — resolves hostnames and validates resolved IP addresses.

Size Limits

Endpoint Limit File/Line
Pre-receive hooks 1MB PreReceiveController
Package uploads 200MB PackageRegistryController
Hook requests 1MB body HookController
Runner proto 50MB runner_controller.ex:700
Artifact uploads 1GB actions_artifact_controller.ex:76
Cache chunk upload 200MB actions_cache_controller.ex:91

Data Validation

  • Ecto changesets — all schema writes use validate_required, validate_inclusion, unique_constraint
  • SHA validation — pre-receive hooks validate 40-character hex SHA format
  • Ref format parsing — git ref updates validated against expected format
  • Token format validation — personal access tokens, runner tokens validated on use

HTML/Markdown Sanitization

  • lib/git_gud/markdown.ex — HTML sanitization before rendering user-generated content
    • Processes markdown input through sanitization pipeline
    • Strips dangerous elements (scripts, event handlers, javascript: URIs)
    • Uses Floki or ex_html_sax for DOM manipulation
    • Allows safe subset of HTML (bold, italic, links, code blocks, etc.)

Security Observations

Medium

Markdown sanitization rules need periodic review

  • Sanitization configuration should be verified against latest OWASP XSS cheatsheet
  • New XSS vectors discovered regularly — ensure sanitization is current
  • Recommendation: add test cases for known XSS payloads (e.g., <svg/onload=alert(1)>, <iframe src=javascript:...>)

Size limits can cause memory exhaustion

  • actions_artifact_controller.ex:76 — read_body/2 with length: 1_000_000_000 (1 GB)
    • If multiple concurrent artifact uploads hit the limit, memory exhaustion is possible
    • Recommendation: add per-user or per-repo concurrent upload limits
  • actions_cache_controller.ex:91 — 200MB per chunk upload
    • Consider chunking or streaming for very large caches

No file type validation in storage controller

  • StorageController relies on upstream validation for file types
  • No virus/malware scanning pipeline
  • Recommendation: add content-type validation based on actual file content (magic bytes) not just headers
  • Consider adding malware scanning (e.g., ClamAV integration) for uploaded artifacts

No rate limiting on login/register endpoints

  • Only MFA attempts tracked via TwoFactorAttempts
  • Login/register endpoints can be hammered for brute-force or credential stuffing
  • Recommendation: add IP-based rate limiting (e.g., 10 requests/minute per IP for login)
  • Recommendation: add CAPTCHA or proof-of-work after N failed attempts