Repository navigation
Require generic_paths for generic upstreams with credentials - #581
Merged
Merged
Conversation
A generic upstream forwards any path below /generic/{name}/. The
documented mise setup puts a GITHUB_TOKEN on api.github.com to raise
the rate limit, so anyone who could reach the proxy could make any GET
request with that token, including for private repositories it can
read, and the answers went into the shared metadata cache. upstream.git
already refuses an upstream with credentials unless it lists its repos.
upstream.generic_paths now lists, per generic upstream, the paths it
may serve, with the same pattern syntax as git repos. Other paths
answer 404 without reaching the upstream, and so does a path holding
'%', '?', '#' or a backslash, which the upstream could read as a
different path than the one that matched. Config validation refuses a
generic upstream that upstream.auth has credentials for unless it has
generic_paths, which also covers a github.com token reaching the
generic github upstream. Upstreams without credentials keep serving
every path.
The docs and example config show the paths mise needs and recommend a
fine-grained token limited to public repositories.
simonchrz
added
the
breaking
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
A generic upstream forwards any path below
/generic/{name}/. With the documented mise setup, a bearerGITHUB_TOKENonhttps://api.github.comto raise the rate limit, that means any API call anyone reaching the proxy makes is sent with the operator's token, and the answer lands in the shared metadata cache.upstream.gitalready refuses an upstream with credentials unless it lists itsrepos; this applies the same rule to generic upstreams.upstream.generic_paths: per generic upstream, the paths after/generic/{name}/it may serve, using therepospattern syntax (path.Match, trailing/**for anything nested). Other paths answer 404 without contacting the upstream. Paths containing%,?,#or a backslash are also refused for these upstreams, so the path that matched is the path the upstream sees.upstream.authhas credentials for unless it hasgeneric_paths, with an error naming the setting. This also covers agithub.comtoken reaching the genericgithubupstream.name: urlform and serve every path, as before.repos/*/*/releases,repos/*/*/releases/**,repos/*/*/tags) and recommend a fine-grained token with read-only access to public repositories.Upgrade note: a config with
upstream.authcredentials covering a generic upstream's URL won't start untilupstream.generic_pathslists that upstream's paths.