scriptoriumadmin/GitNexus
1
0
Fork 0
mirror of https://github.com/abhigyanpatwari/GitNexus.git synced 2026-09-11 22:53:04 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 9

fix: use module-level BLOCKED_HOSTNAMES set and add metadata.internal

Browse source
This commit is contained in:
OpenClaw 2026-04-10 00:15:07 +05:30
parent 131e195324
commit f2fc02b636
1 changed files with 2 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
gitnexus/src/server/git-clone.ts
View file

@ -25,6 +25,7 @@ export function getCloneDir(repoName: string): string {
// Cloud metadata hostnames that must never be reachable via user-supplied URLs
const BLOCKED_HOSTNAMES = new Set([
'localhost',
'metadata.google.internal',
'metadata.azure.com',
'metadata.internal',
@ -50,8 +51,7 @@ export function validateGitUrl(url: string): void {
const host = parsed.hostname.toLowerCase();
// Block known dangerous hostnames (cloud metadata services)
const blockedHostnames = ['localhost', 'metadata.google.internal', 'metadata.azure.com'];
if (blockedHostnames.includes(host)) {
if (BLOCKED_HOSTNAMES.has(host)) {
throw new Error('Cloning from private/internal addresses is not allowed');
}