The Ansible executor passed the user-controlled git repository `url` (from
playbook YAML or a `git_repository` resource) straight into `git clone`,
`git ls-remote` and `git remote add` on the worker host. A URL that git parses
as an option — e.g. `--upload-pack=<cmd>` — turns `git ls-remote <url> HEAD`
into arbitrary command execution on the host, outside any job sandbox. Non-http
transports (`ext::`, `file://`, local paths) similarly run programs or read
host files.
Add `validate_git_repo_url` in windmill-common: reject a leading `-`, reject
remote-helper `::` syntax, and allow only the `http(s)`, `ssh`, `git` and
scp-like `[user@]host:path` transports. Also reject a `branch`/`commit` that
starts with `-`. Validation runs at every ansible entry point that spawns git,
covering both the inline-YAML and resource-provided URL paths.
CWE-88 (argument injection) / CWE-78. Reported by Nitin Gavhane.
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
* feat: add GitHub Enterprise Server (GHES) support for GitHub App git sync
Add a self-managed GitHub App mode alongside the existing managed
(stats.windmill.dev) mode, enabling git sync for GitHub Enterprise Server
and custom GitHub App installations.
Backend:
- Parameterize GitHub API URLs (no more hardcoded github.com)
- Add GITHUB_ENTERPRISE_APP_SETTING global setting
- Add OpenAPI specs for ghes_installation_callback and ghes_config endpoints
Frontend:
- Add instance settings UI for configuring self-managed GitHub Apps
with setup instructions and validation
- GHES installation flow in gh_success page
- Dynamic installation URL based on GHES config
- Increase git sync test connection timeout to 10s
- Block "Review changes" save when settings are invalid
EE companion PR: windmill-labs/windmill-ee-private#<PR_NUMBER>
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* chore: update ee-repo-ref to c74c86b78a66b976fd9968b21f77903723e668ec
This commit updates the EE repository reference after PR #459 was merged in windmill-ee-private.
Previous ee-repo-ref: 45e4550110799525b5502cf072c8af8132492638
New ee-repo-ref: c74c86b78a66b976fd9968b21f77903723e668ec
Automated by sync-ee-ref workflow.
* sqlx
---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
Co-authored-by: Ruben Fiszel <ruben@windmill.dev>
* Improve minio on flake.nix
* Add first asset parsing logic for ansible
* Correct html gt sign
* Decouple s3 file picker from drawer
* Factor duplicate code into snippet
* Update S3FilePickerInner to be compatible
* Fix pane shrinking issue
* Git repo viewer
* Change GitRepoViewer
* Endpoints for git repo visualizer
* Move git repo viewer to its own component
* Add button to populate git repo viewer
* Update parser yaml for new ansisble features (repo viewer)
* Reflect parser changes for ansible
* Add button to add the git repo mode of declaration for ansible
* Factor function
* Playbook + inventories into the drawer
* Add button to add inventories from s3
* Move tests to lib.rs
* Inventory loading from s3
* Move get github app token logic to be reused by ansible
* Update parser and ansible executor
* Use the correct path for inventories
* Add nushell to flake for wasm builds
* Add published parser
* Update hubPaths with clone and upload to s3
* Update ee-repo to the branch ref
* Fix npm run check
* Update cargo.lock
* Change labels on buttons
* Remove debug log
* Update ee-repo-ref
* Fix ee issues
* Update ee-repo ref
* Fix typo
* Fix ee
* Update ee-repo-ref
* Fix missing imports
* Unused var
* Fix typo
* Layout improvents
* Fix typos
* Remove unused function and log
---------
Co-authored-by: Ruben Fiszel <ruben@windmill.dev>
Ruben FiszelandClaude Opus 4.8
Pyraandwindmill-internal-app[bot]
wendrulandRuben Fiszel