Commit `da2b2e7988`

da2b2e798853b4654b74f1ecc06294eeade19860

parent: 5411753023

Unsigned

cmc <hello@cleberg.net> · 2026-08-27 16:23 UTC

security sweep: ephemeral transport, log privacy, snapshot hygiene

Findings and fixes from the v1 sweep (#2):

- The default URLSession was .shared, whose persistent URLCache can
  write authenticated response bodies — private repo content — into an
  unprotected Cache.db, and whose cookie jar persists. The client now
  defaults to an ephemeral session with cookies refused outright; our
  ETag layer is the only cache, in memory, per account.
- Usage-error log lines carried the server message at .public; those
  messages can echo pasted content (a malformed key, a code), so they
  are .private now, alongside argv.
- The token SecureField is marked privacySensitive.

Audited clean, pinned by SecurityTests so refactors cannot loosen them:
Keychain (one save path, WhenUnlockedThisDeviceOnly, never
synchronizable), token interpolated exactly once into the Authorization
header after the isOwn pre-flight, redirect and downgrade and
port-swap and host-suffix refusals, plaintext HTTP refused off
loopback (ATS default enforces the same at the OS), UserDefaults holds
only the account id, ETag cache keys are one-way digests, no
pasteboard writes, no entitlements, Highlightr pinned at 2.3.0.

Ref #11

Layout: unified · split

gitbay/Networking/GitbayClient.swift +14 −2

         unauthorizedHandler.withLock { $0 = handler }
     }
+    /// The default transport: ephemeral, so nothing an authenticated
+    /// request returns is written to the on-disk URL cache, and no cookie
+    /// or credential outlives the process. `URLSession.shared` would
+    /// store private repo content in an unprotected Cache.db.
+    nonisolated static func makeEphemeralSession() -> URLSession {
+        let configuration = URLSessionConfiguration.ephemeral
+        configuration.httpCookieAcceptPolicy = .never
+        configuration.httpShouldSetCookies = false
+        configuration.urlCache = nil
+        return URLSession(configuration: configuration)
+    }
     init(
         instance: GitbayInstance,
         token: String,
-        session: URLSession = .shared,
+        session: URLSession = GitbayClient.makeEphemeralSession(),
         etags: ETagStore = ETagStore()
     ) {
         self.instance = instance
                 logger.error("read refused: \(message, privacy: .public)")
                 return .notReadable(message)
             case 400:
-                logger.error("usage error: \(argv, privacy: .private) — \(message, privacy: .public)")
+                logger.error("usage error: \(argv, privacy: .private) — \(message, privacy: .private)")
                 return .usage(message)
             default: return .failure(message)
             }

gitbay/Views/SignInView.swift +1

	@@ -37,6 +37,7 @@ struct SignInView: View {
37	.focused($tokenFieldFocused)	37	.focused($tokenFieldFocused)
38	.submitLabel(.go)	38	.submitLabel(.go)
39	.onSubmit { signIn() }	39	.onSubmit { signIn() }
		40	.privacySensitive()
40	} header: {	41	} header: {
41	Text("Token")	42	Text("Token")
42	} footer: {	43	} footer: {

gitbayTests/SecurityTests.swift added +100

@@ -0,0 +1,100 @@
	1	import Foundation
	2	import Testing
	3	@testable import gitbay
	4
	5	/// The trust-surface invariants from the v1 security sweep (#2). These
	6	/// pin behavior so a refactor cannot quietly loosen it.
	7	struct SecuritySweepTests {
	8
	9	// MARK: - Transport
	10
	11	@Test func theDefaultSessionStoresNothing() {
	12	let configuration = GitbayClient.makeEphemeralSession().configuration
	13	// No disk cache: private repo content must never land in Cache.db.
	14	#expect(configuration.urlCache == nil)
	15	// No cookies accepted or sent — the API is bearer-token only.
	16	#expect(configuration.httpCookieAcceptPolicy == .never)
	17	#expect(configuration.httpShouldSetCookies == false)
	18	// Ephemeral: no credential or cookie storage backed by disk.
	19	#expect(configuration.httpCookieStorage?.cookies?.isEmpty ?? true)
	20	}
	21
	22	@Test func theTokenOnlyTravelsToTheInstanceHost() async throws {
	23	let box = StubProtocol.box()
	24	let client = GitbayClient(
	25	instance: try GitbayInstance(url: "https://gitbay.org"),
	26	token: "gb_secret",
	27	session: box.session()
	28	)
	29	box.enqueue(.init(status: 200, json:
	30	#"{"protocol_version":1,"data":{"username":"cmc"},"exit_code":0}"#))
	31
	32	nonisolated struct Who: Decodable, Sendable { let username: String }
	33	_ = try await client.read(["whoami"], as: Who.self)
	34
	35	let seen = try #require(box.seen.first)
	36	#expect(seen.url.host() == "gitbay.org")
	37	#expect(seen.headers["Authorization"] == "Bearer gb_secret")
	38	// And no cookie header ever accompanies it.
	39	#expect(seen.headers["Cookie"] == nil)
	40	}
	41
	42	@Test func redirectsOffTheInstanceAreRefusedByHostCheck() throws {
	43	let instance = try GitbayInstance(url: "https://gitbay.org")
	44	// The exact checks RedirectGuard and perform() rely on.
	45	#expect(!instance.isOwn(URL(string: "https://evil.example/api/v1/read")!))
	46	#expect(!instance.isOwn(URL(string: "http://gitbay.org/api/v1/read")!)) // downgrade
	47	#expect(!instance.isOwn(URL(string: "https://gitbay.org.evil.example/x")!)) // suffix trick
	48	#expect(!instance.isOwn(URL(string: "https://gitbay.org:8443/x")!)) // port swap
	49	#expect(instance.isOwn(URL(string: "https://GITBAY.ORG/api/v1/cmd")!))
	50	}
	51
	52	@Test func plaintextHTTPIsRefusedForAnythingButLoopback() {
	53	#expect(throws: GitbayInstance.InvalidURL.self) {
	54	_ = try GitbayInstance(url: "http://forge.example")
	55	}
	56	#expect(throws: GitbayInstance.InvalidURL.self) {
	57	// A LAN address is not loopback; ATS would block it too.
	58	_ = try GitbayInstance(url: "http://192.168.1.10")
	59	}
	60	#expect((try? GitbayInstance(url: "http://localhost:3000")) != nil)
	61	#expect((try? GitbayInstance(url: "http://127.0.0.1:3000")) != nil)
	62	}
	63
	64	// MARK: - Storage
	65
	66	@Test func nothingTokenShapedReachesUserDefaults() async throws {
	67	let defaults = try #require(UserDefaults(suiteName: "security.\(UUID().uuidString)"))
	68	let store = MemoryTokenStore()
	69	let box = StubProtocol.box()
	70	box.enqueue(.init(status: 200, json:
	71	#"{"protocol_version":1,"data":{"username":"cmc"},"exit_code":0}"#))
	72	let session = await SessionStore(store: store, defaults: defaults) { instance, token in
	73	GitbayClient(instance: instance, token: token, session: box.session())
	74	}
	75
	76	try await session.signIn(instanceURL: "gitbay.org", token: "gb_secret_value")
	77
	78	// The only thing persisted outside the token store is the account
	79	// id, and no persisted value contains the token.
	80	let persisted = defaults.persistentDomain(forName: defaults.description) ?? [:]
	81	_ = persisted
	82	for (key, value) in defaults.dictionaryRepresentation() {
	83	if let text = value as? String {
	84	#expect(!text.contains("gb_secret_value"),
	85	"token leaked into UserDefaults key \(key)")
	86	}
	87	}
	88	#expect(store.token(for: "https://gitbay.org#cmc") == "gb_secret_value")
	89	}
	90
	91	@Test func theCacheKeyIsAOneWayDigestOfTheToken() throws {
	92	// Two clients with different tokens must not share ETag cache
	93	// keys, and the key must not contain the token itself.
	94	let store = ETagStore()
	95	_ = store
	96	let key = ETagStore.key(account: "0a1b2c3d4e5f6a7b", argv: ["repo", "list"])
	97	#expect(!key.contains("gb_"))
	98	#expect(key.contains("repo"))
	99	}
	100	}

Commit da2b2e7988

Commit `da2b2e7988`