Commit `0c7b382159`

0c7b382159eb8ab7f8c6840626d0fce3fa15eb13

Verified · cmc

cmc <hello@cleberg.net> · 2026-09-29 02:27 UTC

control: mirror add refuses a numerically written host

Ref #298

Layout: unified · split

CHANGELOG.org +3

   global gitconfig are ignored. A source that redirects (a renamed
   repository) fails; import from the URL it redirects to. Needs git
   2.37 or later on the server (#298).
+- =repo mirror add= refuses a host written numerically (=127.1=,
+  =2130706433=, =0x7f.1=) when the mirror is added, rather than at its
+  first sync (#298).
 - A browser session creates credentials and grants access — keys, PGP
   keys, tokens, verified addresses, org and repository roles, transfers,
   webhooks, secrets, mirrors, and the admin promote/enable actions —

internal/control/mirrorcmd.go +9

 	"errors"
 	"fmt"
 	"io"
+	"net/url"
 	"strconv"
 	"strings"
+	"gitbay.org/gitbay/internal/gitpin"
 	"gitbay.org/gitbay/internal/policy"
 	"gitbay.org/gitbay/internal/protocol"
 	"gitbay.org/gitbay/internal/store"
 	if path == "" || urlArg == "" || (direction != "push" && direction != "pull") {
 		return c.usage()
 	}
+	// Sync refuses a numerically written host; say so now, before a
+	// resolver gets to read it.
+	if u, err := url.Parse(urlArg); err == nil {
+		if err := gitpin.CheckHost(u.Hostname()); err != nil {
+			return c.failInput(err)
+		}
+	}
 	// The worker's git process dials this URL from the server: same SSRF
 	// surface as a webhook target, same rules.
 	if err := webhook.ValidateURL(urlArg, c.Cfg.Webhooks.AllowLocal); err != nil {

internal/control/mirrorcmd_test.go added +29

@@ -0,0 +1,29 @@
	1	package control
	2
	3	import (
	4	"strings"
	5	"testing"
	6
	7	"gitbay.org/gitbay/internal/protocol"
	8	)
	9
	10	// mirror add refuses a host sync would refuse as numeric, on an
	11	// instance that allows local targets or not, and stores nothing (#298).
	12	func TestMirrorAddRefusesNumericHost(t *testing.T) {
	13	for _, allowLocal := range []bool{true, false} {
	14	for _, host := range []string{"127.1", "2130706433", "0x7f.1"} {
	15	c, errOut, st, _ := importCtx(t, allowLocal)
	16	code := Dispatch(c, []string{"repo", "mirror", "add", "alice/app", "https://" + host + "/x.git", "--direction", "pull"})
	17	if code != protocol.ExitUsage \|\| !strings.Contains(errOut.String(), "numeric address") {
	18	t.Fatalf("%s (allow_local %v): exit %d, %q", host, allowLocal, code, errOut.String())
	19	}
	20	repo, err := st.RepoByPath("alice/app")
	21	if err != nil {
	22	t.Fatal(err)
	23	}
	24	if ms, err := st.ListMirrors(repo.ID); err != nil \|\| len(ms) != 0 {
	25	t.Fatalf("%s: mirrors %v, %v", host, ms, err)
	26	}
	27	}
	28	}
	29	}

internal/gitpin/gitpin.go +13 −4

 	if host == "" {
 		return Remote{}, fmt.Errorf("URL has no host")
 	}
-	if net.ParseIP(host) == nil && numericHost(host) {
+	if err := CheckHost(host); err != nil {
-		// 127.1, 2130706433 and 0x7f.1 are loopback to curl's parser
+		return Remote{}, err
-		// but not to Go's; refuse rather than leave them to a resolver.
-		return Remote{}, fmt.Errorf("host %q is a numeric address in a form other than dotted decimal; write it as a.b.c.d", host)
 	}
 	ips, err := lookup(ctx, host)
 	if err != nil {
 	return Remote{URL: u, IPs: ips}, nil
 }
+// CheckHost refuses a host written as a number in a form other than
+// an IP literal: 127.1, 2130706433 and 0x7f.1 are loopback to curl's
+// parser but not to Go's, so they are refused rather than left to a
+// resolver.
+func CheckHost(host string) error {
+	if net.ParseIP(host) == nil && numericHost(host) {
+		return fmt.Errorf("host %q is a numeric address in a form other than dotted decimal; write it as a.b.c.d", host)
+	}
+	return nil
+}
 // numericHost reports whether every label of host is a decimal, octal
 // or hex number, the shapes inet_aton reads as an IPv4 address.
 func numericHost(host string) bool {

Commit 0c7b382159