dreampiler/kandev
1
0
Fork 0
Code Issues 43 Pull Requests Actions 2 Packages Projects Releases Wiki Activity

fix(gitcredentials): reject unsafe clone authorities (#2869)

Browse Source 
Co-authored-by: ayattara <alassane.yattara@savoirfairelinux.com>
Co-authored-by: Carlos Florencio <carlosmflorencio@gmail.com>
This commit is contained in:
Alassane
2026-08-21 05:34:19 -04:00
committed by GitHub
parent 08f07b709e
commit 05fe86fd76
5 changed files with 269 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/specs/integrations/github-authentication.md
+3 -2
View File
@@ -435,8 +435,9 @@ post-signature processing failures produce `failing`; a later valid successful d
- Public base URL validation requires a canonical HTTPS origin with no credentials, query, or
fragment and rejects loopback, private, link-local, or non-globally-routable DNS results. Kandev
does not fetch the supplied URL as validation.
- Repository identity accepts credential-free HTTPS and SSH remote forms. It rejects an SSH
password, query, or fragment before canonicalization, and an error never contains the rejected
- Repository identity accepts credential-free HTTPS and SSH remote forms. Authorities must remain
ASCII-only and percent-free before URL parsing or case folding. It rejects an SSH password,
query, or fragment before canonicalization, and an error never contains the rejected
secret-bearing remote.
- App private keys, client secrets, webhook secrets, personal tokens, and live installation tokens
never enter executor environments. Only brokered PAT/CLI tokens or repository-restricted