-
Notifications
You must be signed in to change notification settings - Fork 39
sync: Missing origin-ownership check allows known peer to force-fetch into existing mirror #432
Copy link
Copy link
Open
Labels
crate:nodegitlawb-node — the serving node and REST APIgitlawb-node — the serving node and REST APIkind:securityVulnerability fix or hardeningVulnerability fix or hardeningsev:highMajor break or real security/trust risk, no easy workaroundMajor break or real security/trust risk, no easy workaroundsubsystem:apiNode REST API request/response surfaceNode REST API request/response surfacesubsystem:peersPeer announce, discovery, and registryPeer announce, discovery, and registrysubsystem:replicationMirror, replica, and cross-node syncMirror, replica, and cross-node sync
Description
Activity
Metadata
Metadata
Assignees
Labels
crate:nodegitlawb-node — the serving node and REST APIgitlawb-node — the serving node and REST APIkind:securityVulnerability fix or hardeningVulnerability fix or hardeningsev:highMajor break or real security/trust risk, no easy workaroundMajor break or real security/trust risk, no easy workaroundsubsystem:apiNode REST API request/response surfaceNode REST API request/response surfacesubsystem:peersPeer announce, discovery, and registryPeer announce, discovery, and registrysubsystem:replicationMirror, replica, and cross-node syncMirror, replica, and cross-node sync
Summary
In
crates/gitlawb-node/src/sync.rs:243-245andcrates/gitlawb-node/src/api/peers.rs:352-383,process_batchusesitem.node_didsolely to queryresolve_origin_url. It does not verify thatnode_didmatches the repository's recorded origin or owner DID.Impact
As noted in PR #274's residuals, a well-formed slug matching an existing local mirror allows any known peer to enqueue a sync, repointing
remote.originand overwriting refs through the mirror refspec.Remediation
item.node_didmatches the repository's recorded origin DID before triggeringfetch_repo.