scriptoriumadmin/GitNexus
1
0
Fork 0
mirror of https://github.com/abhigyanpatwari/GitNexus.git synced 2026-09-20 00:11:37 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 7
GitNexus/gitnexus/test/unit
History
@aaronjmars 95814847bd
fix(security): block IPv4-compatible IPv6 and NAT64 SSRF bypasses in validateGitUrl (#1148) 
* fix(security): block IPv4-compatible IPv6 and NAT64 SSRF bypasses

Vulnerability: SSRF via IPv6 forms that embed IPv4 addresses
Severity: high
Location: gitnexus/src/server/git-clone.ts:assertNotPrivateIPv6

validateGitUrl() blocks ::ffff:x.x.x.x (IPv4-mapped) but two related
forms still slipped through — both routable to the embedded IPv4 on
common stacks:

1. IPv4-compatible IPv6 (RFC 4291 § 2.5.5.1, deprecated):
   http://[::127.0.0.1]/  — Node's URL parser collapses this to
   "::7f00:1" with no ::ffff: marker, so the existing check missed it.

2. NAT64 well-known prefix (RFC 6052: 64:ff9b::/96, plus RFC 8215's
   64:ff9b:1::/48 local prefix): a host with NAT64 enabled translates
   64:ff9b::7f00:1 to 127.0.0.1, reaching loopback.

Impact: an attacker who can submit a clone URL to /api/analyze (any
caller in the CORS-allowlisted origin set — localhost, RFC 1918 LAN,
or gitnexus.vercel.app) could direct git clone at loopback or cloud
metadata addresses (169.254.169.254 → ::a9fe:a9fe, 64:ff9b::a9fe:a9fe).

Fix: extend assertNotPrivateIPv6 to reject any address compressed to
::xxxx[:yyyy] and any address starting with the NAT64 prefix
64:ff9b:. Tests added for both forms plus the cloud-metadata variants.

* fix(security): block 6to4 SSRF bypass and add expanded-form regression tests

Address review findings on PR #1148:

- Block 6to4 (2002::/16, RFC 3056). The prefix encodes an IPv4 address in
  bits 17-48, so 2002:7f00:0001::* routes to 127.0.0.1 on 6to4-capable
  stacks. RFC 7526 deprecated the protocol and the public relay anycast
  has been retired, so broad-blocking has near-zero false-positive cost.

- Expand the NAT64 comment to justify the broader-than-CIDR check: the
  whole 64:ff9b::/32 block is IANA-reserved for IPv4-IPv6 translation, so
  a future narrower CIDR refactor would silently re-open the bypass for
  64:ff9b:1::/48 or any new translation range.

- Add tests for expanded / zero-padded IPv4-compatible IPv6 forms
  ([0:0:0:0:0:0:7f00:1], fully zero-padded, mixed [0:...:127.0.0.1]).
  These pin the assumption that the WHATWG URL parser collapses these
  inputs to ::xxxx[:yyyy]; without them, a future Node anomaly would
  silently regress the bypass.

- Add public IPv6 positive tests (Cloudflare 2606:4700::, Google
  2001:4860::). Regression guard against over-blocking.

- Add NAT64 + RFC1918 embedded-IP tests (10/8, 172.16/12, 192.168/16) to
  document SSRF coverage explicitly rather than relying on the prefix
  check.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* style: apply prettier formatting to git-clone.test.ts

---------

Co-authored-by: aeonframework <aeon@aaronjmars.com>
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Co-authored-by: Gergo Magyar <gergomagyar@icloud.com>
2026-05-04 08:08:46 +01:00
..
call-routing feat(ingestion): language-agnostic heritage extractor with config+factory pattern (#890) 2026-04-17 17:51:17 +01:00
group feat(group): auto-discover Rust workspace cross-crate contracts (#1256) 2026-05-03 01:43:22 +01:00
import-resolution feat: configure prettier with pre-commit hook (#563) 2026-03-28 14:58:04 +00:00
mcp feat: cross-repo impact analysis (#794) — @repo MCP routing + group resources (#984) 2026-04-20 11:55:07 +01:00
model feat(shared): add scope-resolution types + constants (#910, RFC #909 Ring 1) (#949) 2026-04-18 12:55:09 +01:00
named-bindings refactor: SICP-informed LanguageProvider architecture (#488) 2026-03-24 13:42:39 +00:00
scope-resolution feat(go): implement scope resolution hooks for Go language support (#1302) 2026-05-04 07:29:11 +01:00
shadow chore(shared): apply Ring 2 SHARED review follow-ups in one diff (#964) 2026-04-18 18:40:29 +01:00
ai-context.test.ts fix(cli): only match <!-- gitnexus:* --> markers at section position (#1041) (#1042) 2026-04-23 07:58:07 +01:00
analyze-api.test.ts feat: configure prettier with pre-commit hook (#563) 2026-03-28 14:58:04 +00:00
analyze-job.test.ts feat: configure prettier with pre-commit hook (#563) 2026-03-28 14:58:04 +00:00
analyze-worker-timeout.test.ts fix(cli): surface silent finalize-skips so analyze cannot exit 0 without persisting (#1169) (#1237) 2026-04-30 21:36:28 +01:00
api-graph-streaming.test.ts [codex] fix large repository graph loading (#732) 2026-04-09 17:40:24 +01:00
ast-cache.test.ts fix: guard createASTCache against zero maxSize to prevent LRU cache crash 2026-03-02 08:47:20 +00:00
ast-utils.test.ts feat(embeddings): AST-aware chunking with offset-based splitting (#889) 2026-04-16 22:55:04 +01:00
binding-accumulator.test.ts refactor(pipeline): DAG-based phase architecture + container-logic extraction to LanguageProvider (#809) 2026-04-13 20:31:05 +01:00
bm25-search.test.ts fix(search): create FTS indexes during analyze (#1107) 2026-04-27 11:00:32 +01:00
call-attribution-issue-1166.test.ts fix(typescript): name HOC-wrapped const declarations (forwardRef / memo / useCallback / useMemo / observer) (#1261) 2026-05-03 13:58:09 +01:00
call-extraction.test.ts feat(ingestion): language-agnostic call extractor with config+factory pattern (#877) 2026-04-16 11:45:30 +01:00
call-form.test.ts Extract registries into model/ module with SemanticModel interface (#786) 2026-04-12 01:06:55 +01:00
call-processor.test.ts feat(ingestion): TypeScript registry-primary scope resolution (Ring 3) (#1050) 2026-04-26 08:23:08 +01:00
calltool-dispatch.test.ts fix(hook): resolve canonical repo root + guard read-only FTS ensure (#1226) 2026-04-30 18:12:03 +01:00
chunker.test.ts feat(embeddings): structural chunking with data-driven CHUNKING_RULES dispatch (#987) 2026-04-20 08:25:31 +01:00
cli-commands.test.ts fix(swift): use official prebuilt parser runtime (#1130) 2026-04-28 09:57:42 +01:00
cli-index-help.test.ts fix: expose detect-changes in direct CLI (#892) 2026-04-20 17:12:25 +01:00
cobol-copy-expander.test.ts feat: configure prettier with pre-commit hook (#563) 2026-03-28 14:58:04 +00:00
cobol-preprocessor.test.ts feat: configure eslint with unused import removal (#564) 2026-03-28 15:28:09 +00:00
cohesion-consistency.test.ts feat: configure prettier with pre-commit hook (#563) 2026-03-28 14:58:04 +00:00
community-processor.test.ts feat: configure prettier with pre-commit hook (#563) 2026-03-28 14:58:04 +00:00
compatible-stdio-transport.test.ts feat: configure prettier with pre-commit hook (#563) 2026-03-28 14:58:04 +00:00
cors.test.ts feat: configure prettier with pre-commit hook (#563) 2026-03-28 14:58:04 +00:00
cross-file-impl.test.ts refactor(pipeline): DAG-based phase architecture + container-logic extraction to LanguageProvider (#809) 2026-04-13 20:31:05 +01:00
cross-file.test.ts refactor(pipeline): DAG-based phase architecture + container-logic extraction to LanguageProvider (#809) 2026-04-13 20:31:05 +01:00
csv-escaping.test.ts refactor: migrate from KuzuDB to LadybugDB v0.15 (#275) 2026-03-15 15:53:01 +00:00
dart-import-resolver.test.ts refactor(ingestion): split ImportSemantics into per-strategy hooks (Strategies 1-4) (#886) 2026-04-16 19:31:44 +01:00
dart-type-extractor.test.ts feat: configure eslint with unused import removal (#564) 2026-03-28 15:28:09 +00:00
embedder.test.ts test: add test suite with vitest (unit + integration + fixtures) 2026-03-01 20:07:02 +05:30
embedding-chunking.test.ts feat(embeddings): structural chunking with data-driven CHUNKING_RULES dispatch (#987) 2026-04-20 08:25:31 +01:00
embedding-config.test.ts fix: add platform-aware semantic fallback (#1150) 2026-04-28 12:21:25 +01:00
embedding-pipeline.test.ts fix: add platform-aware semantic fallback (#1150) 2026-04-28 12:21:25 +01:00
entry-point-scoring.test.ts refactor(ingestion): consolidate per-language patterns into LanguageProvider (#1279) 2026-05-03 10:34:00 +01:00
eval-formatters.test.ts feat: configure prettier with pre-commit hook (#563) 2026-03-28 14:58:04 +00:00
exact-search.test.ts fix: add platform-aware semantic fallback (#1150) 2026-04-28 12:21:25 +01:00
expo-routes.test.ts feat: add Expo Router file-based route detection (#503) 2026-03-25 11:05:55 +00:00
extract-element-type-from-string.test.ts feat: Phase 6 type resolution — for-loop Tier 1c, pattern matching, container descriptors, 10-language coverage (#318) 2026-03-17 17:10:22 +00:00
extract-generic-type-args.test.ts feat: configure prettier with pre-commit hook (#563) 2026-03-28 14:58:04 +00:00
fetch-reason-parsing.test.ts feat: configure prettier with pre-commit hook (#563) 2026-03-28 14:58:04 +00:00
field-extraction.test.ts Extract registries into model/ module with SemanticModel interface (#786) 2026-04-12 01:06:55 +01:00
framework-detection.test.ts refactor(ingestion): consolidate per-language patterns into LanguageProvider (#1279) 2026-05-03 10:34:00 +01:00
git-clone.test.ts fix(security): block IPv4-compatible IPv6 and NAT64 SSRF bypasses in validateGitUrl (#1148) 2026-05-04 08:08:46 +01:00
git-utils.test.ts feat(cli): Fingerprint indexed repos by remote URL to detect sibling-clone graph drift (#982) 2026-04-21 21:58:54 +01:00
git.test.ts fix(mcp): avoid git from non-repo cwd in sibling cwd match (#1138) (#1293) 2026-05-03 09:17:12 +01:00
graph.test.ts feat(python): scope-based call resolution + registry-primary flip + perf + generalization (RFC #909 Ring 3) (#980) 2026-04-21 15:50:00 +01:00
group-service-not-found.test.ts fix(group): surface friendly error when group name not found (#903 regression test) (#989) 2026-04-21 15:52:36 +01:00
has-method.test.ts feat: MethodExtractor configs for Python, PHP, Swift, Dart, Rust, Ruby (#624) 2026-04-03 16:11:31 +01:00
heritage-extraction.test.ts feat(ingestion): language-agnostic heritage extractor with config+factory pattern (#890) 2026-04-17 17:51:17 +01:00
heritage-map.test.ts Extract registries into model/ module with SemanticModel interface (#786) 2026-04-12 01:06:55 +01:00
heritage-processor.test.ts Extract registries into model/ module with SemanticModel interface (#786) 2026-04-12 01:06:55 +01:00
hf-env.test.ts fix(embeddings): bridge HF_ENDPOINT env var to transformers.js env.remoteHost (#1205) (#1252) 2026-05-03 07:37:05 +01:00
hooks.test.ts fix(hook): resolve canonical repo root + guard read-only FTS ensure (#1226) 2026-04-30 18:12:03 +01:00
http-embedder.test.ts feat: configure prettier with pre-commit hook (#563) 2026-03-28 14:58:04 +00:00
hybrid-search.test.ts feat: configure prettier with pre-commit hook (#563) 2026-03-28 14:58:04 +00:00
ignore-service.test.ts test(ignore-service): skip EACCES test under uid=0 (root bypasses chmod) (#1108) 2026-04-27 11:06:16 +01:00
impact-batching-grouping.test.ts feat(group): add sync pipeline, CLI, MCP tools, and monorepo fixture 2026-04-02 00:40:31 +03:00
impact-confidence.test.ts feat: METHOD_IMPLEMENTS edges, overload disambiguation, MethodExtractor unification (#574) (#642) 2026-04-04 18:41:47 +01:00
import-processor.test.ts Extract registries into model/ module with SemanticModel interface (#786) 2026-04-12 01:06:55 +01:00
import-resolver-factory.test.ts fix(python): avoid local matches for external dotted imports (#899) 2026-04-17 11:35:59 +01:00
index-repo-command.test.ts fix(cli): keep GitNexus ignores inside .gitnexus (#1248) 2026-05-01 16:46:05 +01:00
ingestion-utils.test.ts fix(ingestion): two-channel binding lifecycle (closes #1066) + scope-resolution I8 hardening (#1082) 2026-04-26 12:16:09 +01:00
isWriteQuery.test.ts feat: configure prettier with pre-commit hook (#563) 2026-03-28 14:58:04 +00:00
jcl-parser.test.ts feat: configure eslint with unused import removal (#564) 2026-03-28 15:28:09 +00:00
language-skip.test.ts fix(swift): use official prebuilt parser runtime (#1130) 2026-04-28 09:57:42 +01:00
lazy-action.test.ts Improve MCP startup compatibility and lazy-load CLI commands (#207) 2026-03-07 07:47:09 +00:00
lbug-embedding-hashes.test.ts feat(embeddings): AST-aware chunking with offset-based splitting (#889) 2026-04-16 22:55:04 +01:00
lbug-extension-loader.test.ts fix(deps): upgrade @ladybugdb/core to 0.16.0 to resolve native segfaults (#1235) 2026-04-30 17:40:39 +01:00
lbug-readonly-error.test.ts fix(hook): resolve canonical repo root + guard read-only FTS ensure (#1226) 2026-04-30 18:12:03 +01:00
local-backend-maxbuffer.test.ts fix: ENOBUFS in detect_changes by setting maxBuffer on git/rg execFileSync (#957) 2026-04-18 15:58:31 +01:00
max-file-size.test.ts feat(ingestion): make large-file skip threshold configurable (#1044) 2026-04-23 11:07:37 +01:00
method-extraction.test.ts fix(swift): use official prebuilt parser runtime (#1130) 2026-04-28 09:57:42 +01:00
method-props.test.ts feat: same-arity overload disambiguation via type-hash suffix (#651) (#658) 2026-04-05 21:51:55 +01:00
mro-processor.test.ts feat(python): scope-based call resolution + registry-primary flip + perf + generalization (RFC #909 Ring 3) (#980) 2026-04-21 15:50:00 +01:00
noise-filter.test.ts refactor: split global BUILT_IN_NAMES into per-language provider fields (#523) 2026-03-26 12:15:29 +00:00
parse-diff-hunks.test.ts fix: map diff hunks to symbol line ranges in detect_changes (#779) 2026-04-11 11:29:52 +01:00
parse-impl-fallback.test.ts refactor(pipeline): DAG-based phase architecture + container-logic extraction to LanguageProvider (#809) 2026-04-13 20:31:05 +01:00
parser-loader.test.ts fix(deps): pin tree-sitter-c/cpp to fix Windows segfault (#1242) (#1243) 2026-05-01 08:02:16 +01:00
parsing-worker-fallback.test.ts fix: recover worker parse stalls (#1121) 2026-04-27 20:07:03 +01:00
phase-timer.test.ts feat(search): per-phase timing instrumentation for the query pipeline (#953) 2026-04-18 16:30:07 +01:00
pipeline-exports.test.ts test: add test suite with vitest (unit + integration + fixtures) 2026-03-01 20:07:02 +05:30
pipeline-runner.test.ts refactor(pipeline): DAG-based phase architecture + container-logic extraction to LanguageProvider (#809) 2026-04-13 20:31:05 +01:00
platform-capabilities.test.ts fix: add platform-aware semantic fallback (#1150) 2026-04-28 12:21:25 +01:00
process-processor.test.ts feat: configure prettier with pre-commit hook (#563) 2026-03-28 14:58:04 +00:00
receiver-extraction.test.ts Fix HTTP client vs Express route detection and Spring interface attribution (#780) 2026-04-11 11:24:47 +01:00
registry-primary-flag.test.ts feat(go): implement scope resolution hooks for Go language support (#1302) 2026-05-04 07:29:11 +01:00
rel-csv-split.test.ts test(gitnexus): stabilize rel-csv-split stream teardown on Windows (expect.poll) (#1052) 2026-04-23 20:11:54 +01:00
repo-manager-finalize-invariant.test.ts fix(cli): surface silent finalize-skips so analyze cannot exit 0 without persisting (#1169) (#1237) 2026-04-30 21:36:28 +01:00
repo-manager.test.ts fix(cli): keep GitNexus ignores inside .gitnexus (#1248) 2026-05-01 16:46:05 +01:00
resolve-enclosing-owner.test.ts feat(ingestion): language-agnostic heritage extractor with config+factory pattern (#890) 2026-04-17 17:51:17 +01:00
resources.test.ts feat: cross-repo impact analysis (#794) — @repo MCP routing + group resources (#984) 2026-04-20 11:55:07 +01:00
route-tool-detection.test.ts feat: configure prettier with pre-commit hook (#563) 2026-03-28 14:58:04 +00:00
ruby-self-call.test.ts feat(ingestion): language-agnostic heritage extractor with config+factory pattern (#890) 2026-04-17 17:51:17 +01:00
run-analyze.test.ts fix(cli): keep GitNexus ignores inside .gitnexus (#1248) 2026-05-01 16:46:05 +01:00
schema.test.ts feat(ingestion): language-agnostic variable extractor with config+factory pattern (#878) 2026-04-16 13:57:25 +01:00
security.test.ts feat: METHOD_IMPLEMENTS edges, overload disambiguation, MethodExtractor unification (#574) (#642) 2026-04-04 18:41:47 +01:00
semantic-chunk-search.test.ts feat(embeddings): AST-aware chunking with offset-based splitting (#889) 2026-04-16 22:55:04 +01:00
sequential-language-availability.test.ts fix(ingestion): Log skipped sequential parser languages (#1021) 2026-04-23 08:50:38 +01:00
server.test.ts feat(mcp): add tool safety annotations (#1127) 2026-05-03 09:06:41 +01:00
setup-codex.test.ts feat: configure prettier with pre-commit hook (#563) 2026-03-28 14:58:04 +00:00
setup-jsonc.test.ts refactor(setup): migrate all config I/O to mergeJsoncFile (#1031) 2026-04-24 07:33:35 +01:00
setup.test.ts refactor(setup): migrate all config I/O to mergeJsoncFile (#1031) 2026-04-24 07:33:35 +01:00
shape-check.test.ts fix: shape_check false positives — quoted keys, DOM leaks, errorKeys (#501) 2026-03-26 05:43:37 +00:00
shared-type-extractors.test.ts feat: configure prettier with pre-commit hook (#563) 2026-03-28 14:58:04 +00:00
sibling-clone-drift.test.ts fix(mcp): avoid git from non-repo cwd in sibling cwd match (#1138) (#1293) 2026-05-03 09:17:12 +01:00
skill-gen.test.ts feat: configure prettier with pre-commit hook (#563) 2026-03-28 14:58:04 +00:00
skip-git-cli.test.ts fix(cli): keep GitNexus ignores inside .gitnexus (#1248) 2026-05-01 16:46:05 +01:00
staleness.test.ts feat(group): add group infrastructure and contract matching 2026-04-02 00:39:43 +03:00
stdout-silence.test.ts fix(mcp): unify stdout silencing to prevent embedder/pool-adapter conflicts (#645) 2026-04-04 11:56:49 +01:00
structure-processor.test.ts feat: configure prettier with pre-commit hook (#563) 2026-03-28 14:58:04 +00:00
suffix-index-ambiguity.test.ts feat: configure prettier with pre-commit hook (#563) 2026-03-28 14:58:04 +00:00
symbol-resolver.test.ts refactor(pipeline): DAG-based phase architecture + container-logic extraction to LanguageProvider (#809) 2026-04-13 20:31:05 +01:00
symbol-table.test.ts feat(ingestion): language-agnostic heritage extractor with config+factory pattern (#890) 2026-04-17 17:51:17 +01:00
text-generator.test.ts feat(embeddings): structural chunking with data-driven CHUNKING_RULES dispatch (#987) 2026-04-20 08:25:31 +01:00
tool-direct-cli.test.ts fix: expose detect-changes in direct CLI (#892) 2026-04-20 17:12:25 +01:00
tool-process-linking.test.ts fix(mcp): project tool_map flows from handlers (#1113) 2026-04-27 17:13:02 +01:00
tools.test.ts feat(mcp): add tool safety annotations (#1127) 2026-05-03 09:06:41 +01:00
topological-sort.test.ts refactor(pipeline): DAG-based phase architecture + container-logic extraction to LanguageProvider (#809) 2026-04-13 20:31:05 +01:00
transitive-include-closure.test.ts fix: resolve C/C++ cross-file calls through transitive #include chains (#816) 2026-04-14 09:39:17 +01:00
tree-sitter-queries.test.ts feat(ingestion): language-agnostic variable extractor with config+factory pattern (#878) 2026-04-16 13:57:25 +01:00
type-env.test.ts fix(swift): use official prebuilt parser runtime (#1130) 2026-04-28 09:57:42 +01:00
utils.test.ts feat: configure prettier with pre-commit hook (#563) 2026-03-28 14:58:04 +00:00
variable-extraction.test.ts feat(ingestion): language-agnostic variable extractor with config+factory pattern (#878) 2026-04-16 13:57:25 +01:00
vue-sfc-extractor.test.ts feat(vue): Vue SFC support + destructured call result tracking (#604) 2026-04-03 14:18:55 +05:30
web-ui-serving.test.ts fix(serve): serve web UI at root path instead of 404 (#1048) 2026-04-27 13:17:40 +01:00
wiki-flags.test.ts feat: configure prettier with pre-commit hook (#563) 2026-03-28 14:58:04 +00:00
wiki-llm-client.test.ts fix(wiki): Azure OpenAI compat and HTML viewer script injection (#618) 2026-04-01 21:30:43 +05:30
wildcard-synthesis.test.ts refactor(pipeline): DAG-based phase architecture + container-logic extraction to LanguageProvider (#809) 2026-04-13 20:31:05 +01:00
worker-pool-options.test.ts fix: recover worker parse stalls (#1121) 2026-04-27 20:07:03 +01:00