mirror of https://github.com/windmill-labs/windmill.git synced 2026-08-20 16:02:19 +00:00

Files

T

Ruben Fiszel fa7fbd348d fix(security): validate ansible git repository URLs before invoking git (#10759 )

The Ansible executor passed the user-controlled git repository `url` (from
playbook YAML or a `git_repository` resource) straight into `git clone`,
`git ls-remote` and `git remote add` on the worker host. A URL that git parses
as an option — e.g. `--upload-pack=<cmd>` — turns `git ls-remote <url> HEAD`
into arbitrary command execution on the host, outside any job sandbox. Non-http
transports (`ext::`, `file://`, local paths) similarly run programs or read
host files.

Add `validate_git_repo_url` in windmill-common: reject a leading `-`, reject
remote-helper `::` syntax, and allow only the `http(s)`, `ssh`, `git` and
scp-like `[user@]host:path` transports. Also reject a `branch`/`commit` that
starts with `-`. Validation runs at every ansible entry point that spawns git,
covering both the inline-YAML and resource-provided URL paths.

CWE-88 (argument injection) / CWE-78. Reported by Nitin Gavhane.

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

2026-08-19 14:04:39 +02:00

nsjail

fix: stream ansible playbook logs in real time (#10669 )

2026-08-12 21:52:09 +02:00

src

fix(security): validate ansible git repository URLs before invoking git (#10759 )

2026-08-19 14:04:39 +02:00

build.rs

refactor: isolate deno_core into windmill-runtime-nativets subcrate (#7848 )

2026-02-08 09:16:37 +00:00

Cargo.toml

feat: run dbt projects as a first-class Windmill runtime (#10326 )