Fix download mode leak for latest and list handlers #1826
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
ngshiheng
force-pushed
the
fix-download-mode-leaks
branch
from
d7c30de
to
feab0c7
Compare
|
Ah, I kinda understand where you're coming from. Though, the docs did mention blocking certain modules as a use case. Just to explain it from the perspective of our organization, this is one of the primary use cases of Athens - to act as a vendor to supply a set of internal modules to our downstream: downloadURL = "https://proxy.golang.org"
mode = "sync"
download "company.gitlab.com/repo/a" {
mode = "sync"
}
download "company.gitlab.com/repo/b" {
mode = "sync"
}
download "company.gitlab.com/*" {
mode = "none"
}In this case, our users should only have access to |
ngshiheng
force-pushed
the
fix-download-mode-leaks
branch
from
7ade5fc
to
962acf0
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
What is the problem I am trying to address?
Despite being set to restrict download via the download mode file, the
/listand/latesthandlers are still returning data to the user.This presents a serious security issue, as sensitive module information could potentially be exposed to unauthorized parties.
How is the fix applied?
Check if
DownloadModeis set to"none"for a specific module. If so, we just returnerrors.KindNotFound.How is this tested?
download.example.hclfile containing:curl https://proxy.example.com/secret/module/repo/@latestwill return datacurl https://proxy.example.com/bad/module/repo/@latestwill return not found error (404)The same behavior applies to
/listendpoint.What GitHub issue(s) does this PR fix or close?
Fixes #1774