fix: harden GitLab API redirects and CSRF compatibility - #4
Closed
jonschumaker wants to merge 4 commits into
Closed
Conversation
* feat: add GitLab runner provider * fix(gitlab): keep DinD API on private socket * fix: address provider review feedback --------- Co-authored-by: Jonathon Schumaker <jon@curatec.ai>
* chore(main): release 1.9.0 * chore(release): prepare plugin metadata --------- Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
…ect paths Two narrow hardening fixes on top of the GitLab provider work. gitlab_api/gitlab_api_capture passed --location while supplying the API token through `header = "PRIVATE-TOKEN: ..."`. curl strips only the Authorization header on a cross-host redirect, so a 3xx from a self-managed instance would resend the token to whatever host it named. These are plain /api/v4 GETs against the configured base URL and have no reason to follow a redirect off it, so drop -L. GITLAB_PROJECTS was iterated as `for project in $GITLAB_PROJECTS`, which is subject to pathname expansion as well as word splitting. A plausible entry like `group/*` expands against the process CWD, so the advisory queue/stats/public-visibility scans would query whatever directory names happened to match. Split the list with `read -a` instead and emit only well-formed namespace/project paths. The field is telemetry-only and does not define runner scope, so a malformed entry is skipped rather than failing validation and blocking a fleet. gitlab_stats_refresh reads its project list on fd 3 because its per-project status scan is itself a `while read` on stdin.
Owner
Author
|
Superseded after upstream sync PR #5 merged: GitHub retained the pre-sync comparison for this PR. Reopening as a fresh five-file hardening PR from the unchanged branch. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
jonschumaker/mainwith upstream CI Runner Farm 1.9.0PRIVATE-TOKENRoot cause
Removing curl's location flag prevented the normal redirect path, but curl still returns success for 3xx responses and a user-level
.curlrccan re-enable redirects. The endpoint also assumed Unraid always retained a local$csrf_token, which is only true in newer releases.Validation
bash tests/run-linux-checks.sh2026.08.06.1357.10-1.9.0-jcuratec.gitlab.dev.4e1e049ad1d5on Unraid 7.3.0curatec-ai/bedside_assistantjobs completed successfully while the farm autoscaled across three slots