Ruben FiszelandClaude Opus 4.8 bced402f33 harden: reject dash-led git hosts and scrub env on ansible ls-remote ...

Two follow-ups on the URL validation:

- `validate_git_repo_url` accepted `ssh://-oProxyCommand=<cmd>/path` (a dash-led
  host inside an allowed scheme) and relied on git to reject it. git's ssh
  transport passes the host to `ssh` as an argument, so on an older git this is
  command execution. Reject an authority whose host starts with `-`, for both
  the scheme'd and scp-like forms, so validation no longer depends on the
  worker's git version.

- `get_git_repo_full_head_commit_hash` ran `git ls-remote` with the worker's
  full inherited environment (no `env_clear`), so its transport-helper/ssh
  children could read worker secrets such as `DATABASE_URL`. Scrub the env down
  to PROXY/PATH/TZ/GIT_SSH_COMMAND, matching `clone_repo`.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

2026-08-19 12:19:28 +00:00

..

examples

fix: enrich OTEL log records with per-request LogContext (#8812)

2026-04-13 21:50:50 +00:00

src

harden: reject dash-led git hosts and scrub env on ansible ls-remote

2026-08-19 12:19:28 +00:00

tests

perf: declare a settings pass instead of reading one setting at a time (#10698)

2026-08-14 18:03:33 +02:00

Cargo.toml

fix: datatable full schema hangs behind a transaction-pooling postgres proxy (#10352)

2026-07-27 12:32:44 +02:00