repo-import-ssrf.txtar

 1# vi: set ft=conf
 2
 3# Test SSRF protection on repository import.
 4#
 5# Import takes an arbitrary remote URL from any authenticated user and hands it
 6# to a git clone subprocess. Without validation this reaches internal services
 7# and cloud metadata endpoints.
 8
 9# start soft serve
10exec soft serve &
11# wait for SSH server to start
12ensureserverrunning SSH_PORT
13
14# loopback must be rejected
15! soft repo import bad1 http://127.0.0.1:8080/x.git
16stderr 'remote must be a network URL'
17
18# localhost by name must be rejected
19! soft repo import bad2 http://localhost:8080/x.git
20stderr 'remote must be a network URL'
21
22# cloud metadata endpoint must be rejected
23! soft repo import bad3 http://169.254.169.254/latest/meta-data/
24stderr 'remote must be a network URL'
25
26# RFC1918 ranges must be rejected
27! soft repo import bad4 http://10.0.0.1/x.git
28stderr 'remote must be a network URL'
29
30! soft repo import bad5 http://192.168.1.1/x.git
31stderr 'remote must be a network URL'
32
33# git:// is a raw TCP connect and is equally usable for SSRF
34! soft repo import bad6 git://10.0.0.1/x.git
35stderr 'remote must be a network URL'
36
37# non-canonical IPv4 literals resolve differently in Go and libcurl:
38# 0177.0.0.1 is 177.0.0.1 to Go and 127.0.0.1 to libcurl
39! soft repo import bad7 http://0177.0.0.1:8080/x.git
40stderr 'remote must be a network URL'
41
42! soft repo import bad8 http://127.1:8080/x.git
43stderr 'remote must be a network URL'
44
45# non-network schemes are not remotes at all
46! soft repo import bad9 file:///etc/passwd
47stderr 'remote must be a network URL'
48
49# ext:: is arbitrary command execution
50! soft repo import bad10 'ext::whoami'
51stderr 'remote must be a network URL'
52
53# the LFS endpoint is user-supplied too, and is persisted to the repo config
54# where the mirror job later reads it
55! soft repo import bad11 https://1.1.1.1/x.git --lfs-endpoint http://127.0.0.1:9000
56stderr 'remote must be a network URL'
57
58# none of the rejected imports may leave a repository behind
59soft repo list
60! stdout 'bad'
61
62# stop the server
63[windows] stopserver
64[windows] ! stderr .