Skip to content
Snippets Groups Projects
New look: Off

Origins from Packagist/Maven/... are not checked to be URLs

    • Closed Issue created by vlorentz @vlorentz

    A package on Packagist has git@github.com/NickUseGitHub/NickClass as its git repo, which Dulwich interprets as a filesystem path.

    This means we are not validating URLs, and this could potentially be used to read arbitrary files from the worker's filesystem

    Sentry issue: SWH-LOADER-GIT-1AD

    Possible solutions:

    1. make listers like Packagist and Maven that accept arbitrary URLs check they are indeed URLs
    2. make all loaders make that check (but keep the CLI working with local paths)
    3. both

    Migrated from T4670 (view on Phabricator)

    Edited
    To upload designs, you'll need to enable LFS and have an admin enable hashed storage. More information

    Child items ...

    • Activity

    Please register or sign in to reply