-
Notifications
You must be signed in to change notification settings - Fork 39
All issues
Issue creation is restricted in this repository
Issues
is:issue state:open
is:issue state:open
Search results
gl signs requests to any GITLAWB_NODE with no scheme check, so a plaintext remote node sends the signature in cleartext
crate:glgl — the contributor CLIgl — the contributor CLIkind:securityVulnerability fix or hardeningVulnerability fix or hardeningsev:highMajor break or real security/trust risk, no easy workaroundMajor break or real security/trust risk, no easy workaroundsubsystem:apiNode REST API request/response surfaceNode REST API request/response surfacesubsystem:identityDID/UCAN, http-sig auth, push authorizationDID/UCAN, http-sig auth, push authorizationStatus: Open.#413 In Gitlawb/node;Only the allowlist layer of validated_repo_disk_path is covered: the component walk has no test that reaches it
crate:nodegitlawb-node — the serving node and REST APIgitlawb-node — the serving node and REST APIkind:securityVulnerability fix or hardeningVulnerability fix or hardeningsev:highMajor break or real security/trust risk, no easy workaroundMajor break or real security/trust risk, no easy workaroundsubsystem:storageBlob/object store, Arweave, IPFS, archivesBlob/object store, Arweave, IPFS, archivesStatus: Open.#411 In Gitlawb/node;Silent empty results on clone recovery and changelog fetch mask failures as success
crate:glgl — the contributor CLIgl — the contributor CLIcrate:nodegitlawb-node — the serving node and REST APIgitlawb-node — the serving node and REST APIkind:bugDefect fix — wrong or unsafe behaviorDefect fix — wrong or unsafe behaviorsev:mediumDegraded but workaround existsDegraded but workaround existssubsystem:apiNode REST API request/response surfaceNode REST API request/response surfacesubsystem:replicationMirror, replica, and cross-node syncMirror, replica, and cross-node syncsubsystem:storageBlob/object store, Arweave, IPFS, archivesBlob/object store, Arweave, IPFS, archivesStatus: Open.#400 In Gitlawb/node;parse_ref_updates: validate SHAs are hex, not just length 40
crate:nodegitlawb-node — the serving node and REST APIgitlawb-node — the serving node and REST APIkind:bugDefect fix — wrong or unsafe behaviorDefect fix — wrong or unsafe behaviorsev:mediumDegraded but workaround existsDegraded but workaround existssubsystem:apiNode REST API request/response surfaceNode REST API request/response surfacesubsystem:peersPeer announce, discovery, and registryPeer announce, discovery, and registrysubsystem:storageBlob/object store, Arweave, IPFS, archivesBlob/object store, Arweave, IPFS, archivesStatus: Open.#398 In Gitlawb/node;Agent-task read surfaces are not gated behind repo/task visibility rules
crate:nodegitlawb-node — the serving node and REST APIgitlawb-node — the serving node and REST APIkind:securityVulnerability fix or hardeningVulnerability fix or hardeningsev:highMajor break or real security/trust risk, no easy workaroundMajor break or real security/trust risk, no easy workaroundsubsystem:apiNode REST API request/response surfaceNode REST API request/response surfacesubsystem:peersPeer announce, discovery, and registryPeer announce, discovery, and registrysubsystem:visibilityPath-scoped visibility and content withholdingPath-scoped visibility and content withholdingStatus: Open.#395 In Gitlawb/node;gl doctor prints the node URL unsanitized, so ANSI and bidi characters from --node reach the terminal
crate:glgl — the contributor CLIgl — the contributor CLIkind:securityVulnerability fix or hardeningVulnerability fix or hardeningsev:mediumDegraded but workaround existsDegraded but workaround existsStatus: Open.#393 In Gitlawb/node;Migration runner skips a version already recorded under a different name, dropping the DDL silently
crate:nodegitlawb-node — the serving node and REST APIgitlawb-node — the serving node and REST APIkind:bugDefect fix — wrong or unsafe behaviorDefect fix — wrong or unsafe behaviorsev:highMajor break or real security/trust risk, no easy workaroundMajor break or real security/trust risk, no easy workaroundsubsystem:storageBlob/object store, Arweave, IPFS, archivesBlob/object store, Arweave, IPFS, archivesStatus: Open.#389 In Gitlawb/node;GET /repos/{owner}/{repo}/refs returns an empty 200 when the owner is in full did:key form
crate:nodegitlawb-node — the serving node and REST APIgitlawb-node — the serving node and REST APIkind:bugDefect fix — wrong or unsafe behaviorDefect fix — wrong or unsafe behaviorsev:mediumDegraded but workaround existsDegraded but workaround existssubsystem:apiNode REST API request/response surfaceNode REST API request/response surfacesubsystem:identityDID/UCAN, http-sig auth, push authorizationDID/UCAN, http-sig auth, push authorizationsubsystem:storageBlob/object store, Arweave, IPFS, archivesBlob/object store, Arweave, IPFS, archivesStatus: Open.#387 In Gitlawb/node;Unvalidated PR/repo branch refs reach git as options (arbitrary file write via PR diff)
crate:nodegitlawb-node — the serving node and REST APIgitlawb-node — the serving node and REST APIkind:securityVulnerability fix or hardeningVulnerability fix or hardeningsev:criticalData loss, exploitable security, or crash loopData loss, exploitable security, or crash loopsubsystem:apiNode REST API request/response surfaceNode REST API request/response surfaceStatus: Open.#378 In Gitlawb/node;fix(api,sync): Delimit positional arguments in git clone mirror invocations
crate:nodegitlawb-node — the serving node and REST APIgitlawb-node — the serving node and REST APIkind:bugDefect fix — wrong or unsafe behaviorDefect fix — wrong or unsafe behaviorsev:lowCosmetic, cleanup, or nice-to-haveCosmetic, cleanup, or nice-to-havesubsystem:apiNode REST API request/response surfaceNode REST API request/response surfacesubsystem:replicationMirror, replica, and cross-node syncMirror, replica, and cross-node syncStatus: Open.#374 In Gitlawb/node;gl repo create prints a View: URL on gitlawb.com that 404s for any repo not on node.gitlawb.com
crate:glgl — the contributor CLIgl — the contributor CLIkind:bugDefect fix — wrong or unsafe behaviorDefect fix — wrong or unsafe behaviorsev:lowCosmetic, cleanup, or nice-to-haveCosmetic, cleanup, or nice-to-havesubsystem:visibilityPath-scoped visibility and content withholdingPath-scoped visibility and content withholdingStatus: Open.#370 In Gitlawb/node;git push --delete hangs forever: the helper reads receive-pack to EOF, but a delete-only push sends no pack
crate:git-remotegit-remote-gitlawb — the git remote helpergit-remote-gitlawb — the git remote helperkind:bugDefect fix — wrong or unsafe behaviorDefect fix — wrong or unsafe behaviorsev:mediumDegraded but workaround existsDegraded but workaround existssubsystem:apiNode REST API request/response surfaceNode REST API request/response surfaceStatus: Open.#369 In Gitlawb/node;