Ruben Fiszel fa7fbd348d fix(security): validate ansible git repository URLs before invoking git (#10759) ...

The Ansible executor passed the user-controlled git repository `url` (from
playbook YAML or a `git_repository` resource) straight into `git clone`,
`git ls-remote` and `git remote add` on the worker host. A URL that git parses
as an option — e.g. `--upload-pack=<cmd>` — turns `git ls-remote <url> HEAD`
into arbitrary command execution on the host, outside any job sandbox. Non-http
transports (`ext::`, `file://`, local paths) similarly run programs or read
host files.

Add `validate_git_repo_url` in windmill-common: reject a leading `-`, reject
remote-helper `::` syntax, and allow only the `http(s)`, `ssh`, `git` and
scp-like `[user@]host:path` transports. Also reject a `branch`/`commit` that
starts with `-`. Validation runs at every ansible entry point that spawns git,
covering both the inline-YAML and resource-provided URL paths.

CWE-88 (argument injection) / CWE-78. Reported by Nitin Gavhane.

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

2026-08-19 14:04:39 +02:00

..

examples

fix: enrich OTEL log records with per-request LogContext (#8812)

2026-04-13 21:50:50 +00:00

src

fix(security): validate ansible git repository URLs before invoking git (#10759)

2026-08-19 14:04:39 +02:00

tests

perf: declare a settings pass instead of reading one setting at a time (#10698)

2026-08-14 18:03:33 +02:00

Cargo.toml

fix: datatable full schema hangs behind a transaction-pooling postgres proxy (#10352)

2026-07-27 12:32:44 +02:00