vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

hive-forge: credential-helper fails closed when the configured forge URL won't parse

Browse source
This commit is contained in:
damocles 2026-10-04 08:35:05 +02:00 • committed by mara
commit 111c27e225
2 changed files with 39 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

20
hive-forge/src/verbs/credential_helper.rs
View file

@ -62,14 +62,26 @@ pub fn run(args: Args, forge_label: Option<&str>) -> Result<()> {
let (base, token) = resolve_credentials(forge_label)?;
if let Some(requested) = input.lines().find_map(|l| l.strip_prefix("host=")) {
let requested = requested.trim();
// Fail closed, not open: a configured forge URL that won't parse must
// refuse the same as a genuine mismatch would, not skip the check.
// `expected`'s previous `Option` collapsed "doesn't parse" and
// "parses but has no host" into the same `None` that `is_some_and`
// then read as "nothing to check" — exactly backwards for a check
// that exists to close a reported credential leak.
let expected = url::Url::parse(&base)
.ok()
.and_then(|u| u.host_str().map(str::to_owned));
if expected.is_some_and(|e| e != requested.trim()) {
bail!(
match expected {
Some(e) if e == requested => {}
Some(e) => bail!(
"hive-forge credential-helper: refusing to hand the forge token to \
host {requested:?} (configured forge is {base:?})"
);
host {requested:?} (configured forge is {e:?})"
),
None => bail!(
"hive-forge credential-helper: refusing — configured forge URL {base:?} \
does not resolve to a host, cannot verify requested host {requested:?}"
),
}
}