vectrumVectrumPublic

Harden git calls against ref-name argument injection

Fixes the findings in the security review:

- A branch named like "--output=/path" made server-side git commands
  write attacker-controlled commit text to arbitrary files. Pushes of refs
  with a component starting with "-" are now refused by a pre-receive hook
  that both transports run (core.hooksPath under DATA_ROOT/hooks); such
  refs are ignored when listing branches and tags; and every revision
  argument follows --end-of-options and is rejected if it starts with "-"
  (git shortlog still parses options after a single --end-of-options).
  Web edits validate the submitted base commit.
- Session cookies are Secure based on PUBLIC_URL (or SECURE_COOKIES=1)
  instead of the client-supplied X-Forwarded-Proto header.
- Clone URLs and SSH instructions use PUBLIC_URL instead of trusting
  Host / X-Forwarded-Host.
- The SSH server offers the post-quantum hybrid mlkem768x25519-sha256 key
  exchange (patched into ssh2 from mscdex/ssh2#1471; needs Node >= 24.7).

Adds `bun test` with a regression test for the injection.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

Browse Files

JjohannSocommitted 2 weeks ago1 parent aecb85ccommit47dff0e

Showing 15 changed files with 487 additions and 45 deletions.

+5−1README.mdView File

@@ -61,6 +61,8 @@ Anonymous users can clone public repositories without a token.
61	61
62	62	\| Variable \| Default \| Purpose \|
63	63	\| ----------------- \| ----------- \| --------------------------------------------------------- \|
	64	+ \| `PUBLIC_URL` \| request host \| Canonical address, e.g. `https://vectrum.cc`. Used for clone URLs; `https` also makes session cookies `Secure`. Set it in production \|
	65	+ \| `SECURE_COOKIES` \| — \| Set to `1` to mark session cookies `Secure` without `PUBLIC_URL` \|
64	66	\| `DATA_ROOT` \| `./data` \| Where repositories, the database and the SSH host key live \|
65	67	\| `SSH_PORT` \| `2222` \| Port of the built-in SSH server \|
66	68	\| `SSH_LISTEN_HOST` \| `0.0.0.0` \| Interface the SSH server binds to \|
@@ -73,12 +75,14 @@ Data layout:
73	75	data/
74	76	app.db users, sessions, keys, tokens, repos, issues (SQLite)
75	77	ssh_host_ed25519_key generated on first start
	78	+ hooks/ server-side git hooks for every push, rewritten on start
76	79	repos/<owner>/<repo>.git bare git repositories
77	80	```
78	81
79	82	## Security notes
80	83
81		- - Serve the web UI over HTTPS if it's reachable beyond localhost. Session cookies become `Secure` when `X-Forwarded-Proto: https` is set.
	84	+ - Serve the web UI over HTTPS if it's reachable beyond localhost, and set `PUBLIC_URL`. `Host` and `X-Forwarded-*` headers are client-controlled, so they never decide cookie security, and only stand in for `PUBLIC_URL` in development.
	85	+ - Ref names are never passed to git where they could be read as options: pushes of refs with a component starting with `-` are refused by a pre-receive hook, such refs are ignored when reading, and every revision argument follows `--end-of-options`.
82	86	- Private repositories show a 404 page to anyone without access, so their existence isn't revealed.
83	87	- Raw files are served with `nosniff` and a sandboxing CSP, so repository HTML/SVG can't run scripts in the app's origin.
84	88

+2−1app/actions/files.tsView File

@@ -13,7 +13,7 @@ const str = (formData: FormData, key: string) => String(formData.get(key) ?? "")
13	13
14	14	/** Blob sha of a path at a commit, or null if it doesn't exist there. */
15	15	async function blobAt(dir: string, commit: string, path: string) {
16		- return (await git(dir, ["rev-parse", "--verify", "--quiet", `${commit}:${path}`]).catch(() => "")).trim() \|\| null;
	16	+ return (await git(dir, ["rev-parse", "--verify", "--quiet", "--end-of-options", `${commit}:${path}`]).catch(() => "")).trim() \|\| null;
17	17	}
18	18
19	19	/**
@@ -32,6 +32,7 @@ async function commitFromForm(
32	32	) {
33	33	const branch = str(formData, "branch");
34	34	const baseSha = str(formData, "baseSha");
	35	+ if (baseSha && !/^[0-9a-f]{40,64}$/.test(baseSha)) throw new ActionError("Invalid base commit.");
35	36	const head = await revParse(repo.dir, `refs/heads/${branch}`);
36	37
37	38	if (baseSha) {

+2−3app/page.tsxView File

@@ -1,4 +1,3 @@
1		- import { headers } from "next/headers";
2	1	import Link from "next/link";
3	2	import { Card, Surface } from "@unlocalhosted/metalui";
4	3	import { BRAND } from "@/components/brand";
@@ -24,14 +23,14 @@ import { getViewer } from "@/lib/auth";
24	23	import { shortSha, timeAgo } from "@/lib/format";
25	24	import { recentActivity, withActivity } from "@/lib/listing";
26	25	import { listReposForUser, searchRepos } from "@/lib/repos";
	26	+ import { serverHost } from "@/lib/request-origin";
27	27	import { sshCloneUrl } from "@/lib/ssh-config";
28	28	import type { User } from "@/lib/users";
29	29
30	30	export default async function Home() {
31	31	const viewer = await getViewer();
32	32	if (viewer) return <Dashboard viewer={viewer} />;
33		- const host = (await headers()).get("host") ?? "localhost:3000";
34		- return <Landing sshUrl={sshCloneUrl(host, "you/project.git")} />;
	33	+ return <Landing sshUrl={sshCloneUrl(await serverHost(), "you/project.git")} />;
35	34	}
36	35
37	36	const features = [

+2−3app/settings/keys/page.tsxView File

@@ -1,5 +1,4 @@
1	1	import type { Metadata } from "next";
2		- import { headers } from "next/headers";
3	2	import { Accordion, Label as MuLabel } from "@unlocalhosted/metalui";
4	3	import { deleteSshKeyAction } from "@/app/actions/settings";
5	4	import { ConfirmButton } from "@/components/confirm-button";
@@ -11,6 +10,7 @@ import { Alert, Blankslate, Box, Label, PageTitle } from "@/components/ui";
11	10	import { requireViewer } from "@/lib/auth";
12	11	import { formatDate, timeAgo } from "@/lib/format";
13	12	import { listSshKeys } from "@/lib/keys";
	13	+ import { serverHost } from "@/lib/request-origin";
14	14	import { SSH_ENABLED, sshTestCommand } from "@/lib/ssh-config";
15	15	import { AddKeyForm } from "./form";
16	16
@@ -19,8 +19,7 @@ export const metadata: Metadata = { title: "SSH keys" };
19	19	export default async function KeysPage() {
20	20	const viewer = await requireViewer();
21	21	const keys = listSshKeys(viewer.id);
22		- const host = (await headers()).get("host") ?? "localhost:3000";
23		- const test = sshTestCommand(host);
	22	+ const test = sshTestCommand(await serverHost());
24	23
25	24	return (
26	25	<div>

+2−3app/settings/tokens/page.tsxView File

@@ -1,5 +1,4 @@
1	1	import type { Metadata } from "next";
2		- import { headers } from "next/headers";
3	2	import { Label as MuLabel } from "@unlocalhosted/metalui";
4	3	import { deleteTokenAction } from "@/app/actions/settings";
5	4	import { ConfirmButton } from "@/components/confirm-button";
@@ -10,6 +9,7 @@ import { Blankslate, Label, PageTitle, RefChip } from "@/components/ui";
10	9	import { requireViewer } from "@/lib/auth";
11	10	import { formatDate, timeAgo } from "@/lib/format";
12	11	import { canWrite, listReposForUser, repoAccess } from "@/lib/repos";
	12	+ import { serverOrigin } from "@/lib/request-origin";
13	13	import { listTokens, TOKEN_PREFIX } from "@/lib/tokens";
14	14	import { NewTokenForm } from "./form";
15	15
@@ -38,8 +38,7 @@ export default async function TokensPage() {
38	38	fullName: `${r.owner}/${r.name}`,
39	39	writable: canWrite(repoAccess(r, viewer.id)),
40	40	}));
41		- const h = await headers();
42		- const origin = `${h.get("x-forwarded-proto") ?? "http"}://${h.get("host") ?? "localhost:3000"}`;
	41	+ const origin = await serverOrigin();
43	42
44	43	return (
45	44	<div>

+3−0bun.lockView File

@@ -40,6 +40,9 @@
40	40	"sharp",
41	41	"unrs-resolver",
42	42	],
	43	+ "patchedDependencies": {
	44	+ "ssh2@1.17.0": "patches/ssh2@1.17.0.patch",
	45	+ },
43	46	"packages": {
44	47	"@alloc/quick-lru": ["@alloc/quick-lru@5.3.0", "", {}, "sha512-U4+70Pc5ZS9osnCBCE5Jha/ciHM+Yp+CNMNC/7HvYbNRk1Ldd+f7qO65W5qfhu/TCv+/ozljlXXe9Nj8419DMA=="],
45	48

+3−3lib/auth.tsView File

@@ -1,9 +1,10 @@
1	1	import "server-only";
2	2	import { createHash, randomBytes } from "node:crypto";
3	3	import { cache } from "react";
4		- import { cookies, headers } from "next/headers";
	4	+ import { cookies } from "next/headers";
5	5	import { redirect } from "next/navigation";
6	6	import { db } from "./db";
	7	+ import { SECURE_COOKIES } from "./request-origin";
7	8	import { getUserById } from "./users";
8	9
9	10	const SESSION_COOKIE = "session";
@@ -21,11 +22,10 @@ export async function startSession(userId: number) {
21	22	now,
22	23	expires,
23	24	);
24		- const h = await headers();
25	25	(await cookies()).set(SESSION_COOKIE, token, {
26	26	httpOnly: true,
27	27	sameSite: "lax",
28		- secure: h.get("x-forwarded-proto") === "https",
	28	+ secure: SECURE_COOKIES,
29	29	path: "/",
30	30	expires: new Date(expires),
31	31	});

+2−2lib/git-write.tsView File

@@ -48,7 +48,7 @@ export async function commitFiles(
48	48	GIT_COMMITTER_EMAIL: opts.author.email,
49	49	};
50	50	try {
51		- if (opts.parent) await git(dir, ["read-tree", opts.parent], { env });
	51	+ if (opts.parent) await git(dir, ["read-tree", "--end-of-options", opts.parent], { env });
52	52	else await git(dir, ["read-tree", "--empty"], { env });
53	53
54	54	for (const change of opts.changes) {
@@ -66,7 +66,7 @@ export async function commitFiles(
66	66
67	67	const tree = (await git(dir, ["write-tree"], { env })).trim();
68	68	if (opts.parent) {
69		- const parentTree = (await git(dir, ["rev-parse", `${opts.parent}^{tree}`])).trim();
	69	+ const parentTree = (await git(dir, ["rev-parse", "--end-of-options", `${opts.parent}^{tree}`])).trim();
70	70	if (parentTree === tree) throw new GitError("No changes to commit.");
71	71	}
72	72	const args = ["commit-tree", tree];

+73−0lib/git.test.tsaddedView File

++ // Regression tests for git argument injection through ref names (SEC_REPORT #1).
++ // Run with `bun test`.
++ import assert from "node:assert/strict";
++ import { execFileSync } from "node:child_process";
++ import { existsSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
++ import os from "node:os";
++ import path from "node:path";
++ import { after, before, test } from "node:test";
++ const tmp = mkdtempSync(path.join(os.tmpdir(), "vectrum-git-test-"));
++ process.env.DATA_ROOT = path.join(tmp, "data");
++ const target = path.join(tmp, "PWNED");
++ const evilBranch = `--output=${target}`;
++ const sh = (cwd: string, ...args: string[]) => execFileSync("git", args, { cwd, encoding: "utf8", stdio: "pipe" });
++ let git: typeof import("./git");
++ let repo: string;
++ let work: string;
++ before(async () => {
++   git = await import("./git");
++   repo = path.join(tmp, "srv.git");
++   await git.initBareRepo(repo);
++   work = path.join(tmp, "work");
++   sh(tmp, "init", "-q", "-b", "main", work);
++   sh(work, "-c", "user.name=a", "-c", "user.email=a@x", "commit", "-q", "--allow-empty", "-m", "ssh-ed25519 AAAA attacker");
++ });
++ after(() => rmSync(tmp, { recursive: true, force: true }));
++ /** Pushes through spawnService, the way the SSH server runs receive-pack. */
++ function push(refspec: string) {
++   const wrapper = path.join(tmp, "receive-pack.ts");
++   writeFileSync(
++     wrapper,
++     `const { spawnService } = await import(${JSON.stringify(path.join(import.meta.dirname, "git.ts"))});
++ const child = spawnService("git-receive-pack", process.argv[2], { stateless: false });
++ process.stdin.pipe(child.stdin);
++ child.stdout.pipe(process.stdout);
++ child.stderr.pipe(process.stderr);
++ child.on("close", (code) => process.exit(code ?? 1));`,
++   );
++   return sh(work, "push", "--porcelain", `--receive-pack=${process.execPath} ${wrapper}`, repo, refspec);
++ }
++ test("pushes of dash-prefixed ref names are refused", () => {
++   push("HEAD:refs/heads/main");
++   const declined = (e: { stdout?: string }) => /pre-receive hook declined/.test(e.stdout ?? "");
++   assert.throws(() => push(`HEAD:refs/heads/${evilBranch}`), declined);
++   assert.throws(() => push("HEAD:refs/tags/-x"), declined);
++   assert.equal(sh(repo, "for-each-ref", "--format=%(refname)").trim(), "refs/heads/main");
++ });
++ test("dash-prefixed refs that already exist are ignored and never reach git as options", async () => {
++   // Simulate a branch pushed before the hook existed.
++   sh(repo, "update-ref", `refs/heads/${evilBranch}`, "refs/heads/main");
++   sh(repo, "symbolic-ref", "HEAD", `refs/heads/${evilBranch}`);
++   assert.deepEqual((await git.listBranches(repo)).map((b) => b.name), ["main"]);
++   assert.equal(await git.defaultBranch(repo), "main");
++   assert.equal(await git.resolveRefAndPath(repo, [evilBranch]), null);
++   await assert.rejects(git.log(repo, evilBranch), git.GitError);
++   await assert.rejects(git.commitCount(repo, evilBranch), git.GitError);
++   await assert.rejects(git.listContributors(repo, evilBranch), git.GitError);
++   await assert.rejects(git.listTree(repo, evilBranch, ""), git.GitError);
++   assert.equal(existsSync(target), false);
++   // Normal refs still work.
++   assert.equal((await git.log(repo, "main"))[0].subject, "ssh-ed25519 AAAA attacker");
++   assert.equal(await git.commitCount(repo, "main"), 1);
++ });

+75−19lib/git.tsView File

@@ -1,7 +1,8 @@
1	1	import { execFile, spawn } from "node:child_process";
	2	+ import { mkdirSync, writeFileSync } from "node:fs";
2	3	import { access } from "node:fs/promises";
3	4	import path from "node:path";
4		- import { REPOS_ROOT } from "./paths";
	5	+ import { DATA_ROOT, REPOS_ROOT } from "./paths";
5	6
6	7	// Note: this module is also used by the SSH server (outside of React), so it
7	8	// must not import "server-only" or anything from next/*.
@@ -41,6 +42,21 @@ export async function pathExists(p: string) {
41	42
42	43	export class GitError extends Error {}
43	44
	45	+ /**
	46	+ * Ref names may start with "-" (e.g. a pushed branch named "--output=/etc/x"),
	47	+ * and git would parse such a revision as an option. Every revision argument
	48	+ * goes through this and follows "--end-of-options". The check is needed on top
	49	+ * of the marker: `git shortlog` consumes the marker itself and still parses a
	50	+ * following "--output=…" as an option.
	51	+ */
	52	+ function rev(revision: string) {
	53	+ if (revision.startsWith("-")) throw new GitError(`Invalid revision: ${revision}`);
	54	+ return revision;
	55	+ }
	56	+
	57	+ /** Ref names whose short form starts with "-" are refused on push and ignored when reading. */
	58	+ const isSafeRefName = (name: string) => !name.startsWith("-");
	59	+
44	60	type GitOptions = { env?: Record<string, string>; input?: string \| Buffer; maxBuffer?: number };
45	61
46	62	function run<T extends "utf8" \| "buffer">(dir: string, args: string[], encoding: T, opts: GitOptions) {
@@ -88,14 +104,17 @@ export async function lastActivity(dir: string) {
88	104	}
89	105
90	106	export async function isBranch(dir: string, name: string) {
91		- return git(dir, ["show-ref", "--verify", "--quiet", `refs/heads/${name}`]).then(
	107	+ return git(dir, ["show-ref", "--verify", "--quiet", "--end-of-options", `refs/heads/${name}`]).then(
92	108	() => true,
93	109	() => false,
94	110	);
95	111	}
96	112
97		- export async function revParse(dir: string, rev: string) {
98		- return (await git(dir, ["rev-parse", "--verify", "--quiet", `${rev}^{commit}`]).catch(() => "")).trim() \|\| null;
	113	+ export async function revParse(dir: string, revision: string) {
	114	+ const out = await git(dir, ["rev-parse", "--verify", "--quiet", "--end-of-options", `${rev(revision)}^{commit}`]).catch(
	115	+ () => "",
	116	+ );
	117	+ return out.trim() \|\| null;
99	118	}
100	119
101	120	// ---------------------------------------------------------------------------
@@ -116,12 +135,13 @@ export async function listBranches(dir: string): Promise<Branch[]> {
116	135	.map((line) => {
117	136	const [name, sha, date, subject] = line.split("\x1f");
118	137	return { name, sha, date: Number(date) * 1000, subject };
119		- });
	138	+ })
	139	+ .filter((b) => isSafeRefName(b.name));
120	140	}
121	141
122	142	export async function listTags(dir: string) {
123	143	const out = await git(dir, ["for-each-ref", "--format=%(refname:short)", "refs/tags"]);
124		- return out.split("\n").filter(Boolean);
	144	+ return out.split("\n").filter((name) => name && isSafeRefName(name));
125	145	}
126	146
127	147	/** The branch HEAD points to, or the first existing branch if HEAD dangles. */
@@ -151,7 +171,7 @@ export async function resolveRefAndPath(dir: string, segments: string[]) {
151	171	}
152	172
153	173	async function commitExists(dir: string, ref: string) {
154		- return git(dir, ["cat-file", "-e", `${ref}^{commit}`]).then(
	174	+ return git(dir, ["cat-file", "-e", "--end-of-options", `${rev(ref)}^{commit}`]).then(
155	175	() => true,
156	176	() => false,
157	177	);
@@ -170,11 +190,11 @@ export type TreeEntry = {
170	190	};
171	191
172	192	export async function objectType(dir: string, ref: string, filePath: string) {
173		- return (await git(dir, ["cat-file", "-t", `${ref}:${filePath}`]).catch(() => "")).trim() \|\| null;
	193	+ return (await git(dir, ["cat-file", "-t", "--end-of-options", `${rev(ref)}:${filePath}`]).catch(() => "")).trim() \|\| null;
174	194	}
175	195
176	196	export async function listTree(dir: string, ref: string, treePath: string): Promise<TreeEntry[]> {
177		- const out = await git(dir, ["ls-tree", "-z", "-l", `${ref}:${treePath}`]);
	197	+ const out = await git(dir, ["ls-tree", "-z", "-l", "--end-of-options", `${rev(ref)}:${treePath}`]);
178	198	const entries = out
179	199	.split("\0")
180	200	.filter(Boolean)
@@ -199,7 +219,7 @@ export async function listTree(dir: string, ref: string, treePath: string): Prom
199	219
200	220	/** Every file in the tree at `ref`, with its size, for language statistics. */
201	221	export async function listFilesWithSizes(dir: string, ref: string) {
202		- const out = await git(dir, ["ls-tree", "-r", "-z", "-l", ref]);
	222	+ const out = await git(dir, ["ls-tree", "-r", "-z", "-l", "--end-of-options", rev(ref)]);
203	223	return out
204	224	.split("\0")
205	225	.filter(Boolean)
@@ -211,9 +231,11 @@ export async function listFilesWithSizes(dir: string, ref: string) {
211	231	}
212	232
213	233	export async function readBlob(dir: string, ref: string, filePath: string) {
214		- const size = Number((await git(dir, ["cat-file", "-s", `${ref}:${filePath}`])).trim());
	234	+ const size = Number((await git(dir, ["cat-file", "-s", "--end-of-options", `${rev(ref)}:${filePath}`])).trim());
215	235	const tooLarge = size > 2 * 1024 * 1024;
216		- const content = tooLarge ? Buffer.alloc(0) : await gitBuffer(dir, ["cat-file", "blob", `${ref}:${filePath}`]);
	236	+ const content = tooLarge
	237	+ ? Buffer.alloc(0)
	238	+ : await gitBuffer(dir, ["cat-file", "blob", "--end-of-options", `${rev(ref)}:${filePath}`]);
217	239	const binary = content.subarray(0, 8000).includes(0);
218	240	return { size, tooLarge, binary, content };
219	241	}
@@ -262,7 +284,8 @@ export async function log(
262	284	`--format=${COMMIT_FORMAT}`,
263	285	`-n${opts.limit ?? 30}`,
264	286	`--skip=${opts.skip ?? 0}`,
265		- ref,
	287	+ "--end-of-options",
	288	+ rev(ref),
266	289	"--",
267	290	];
268	291	if (opts.path) args.push(opts.path);
@@ -274,14 +297,14 @@ export async function lastCommit(dir: string, ref: string, filePath?: string) {
274	297	}
275	298
276	299	export async function commitCount(dir: string, ref: string) {
277		- return Number((await git(dir, ["rev-list", "--count", ref])).trim());
	300	+ return Number((await git(dir, ["rev-list", "--count", "--end-of-options", rev(ref)])).trim());
278	301	}
279	302
280	303	export type Contributor = { name: string; email: string; commits: number };
281	304
282	305	/** Commit authors reachable from `ref`, most active first. */
283	306	export async function listContributors(dir: string, ref: string): Promise<Contributor[]> {
284		- const out = await git(dir, ["shortlog", "-sne", ref, "--"]);
	307	+ const out = await git(dir, ["shortlog", "-sne", "--end-of-options", rev(ref), "--"]);
285	308	return out
286	309	.split("\n")
287	310	.map((line) => line.match(/^\s(\d+)\t(.?)\s<([^>])>$/))
@@ -291,7 +314,7 @@ export async function listContributors(dir: string, ref: string): Promise<Contri
291	314
292	315	export async function getCommit(dir: string, sha: string) {
293	316	if (!/^[0-9a-f]{4,40}$/i.test(sha)) return null;
294		- const out = await git(dir, ["show", "-s", `--format=${COMMIT_FORMAT}`, sha, "--"]).catch(() => null);
	317	+ const out = await git(dir, ["show", "-s", `--format=${COMMIT_FORMAT}`, "--end-of-options", sha, "--"]).catch(() => null);
295	318	return out ? (parseCommits(out)[0] ?? null) : null;
296	319	}
297	320
@@ -312,7 +335,7 @@ export type FileDiff = {
312	335	export async function diffCommit(dir: string, commit: Commit) {
313	336	// Diff against the first parent, or the empty tree for root commits.
314	337	const base = commit.parents[0] ?? (await git(dir, ["hash-object", "-t", "tree", "/dev/null"])).trim();
315		- const out = await git(dir, ["diff", "--no-color", "-M", "--no-ext-diff", base, commit.sha]);
	338	+ const out = await git(dir, ["diff", "--no-color", "-M", "--no-ext-diff", "--end-of-options", rev(base), rev(commit.sha)]);
316	339	return parseDiff(out);
317	340	}
318	341
@@ -369,12 +392,45 @@ export function parseDiff(out: string): FileDiff[] {
369	392
370	393	export type GitService = "git-upload-pack" \| "git-receive-pack";
371	394
	395	+ const HOOKS_DIR = path.join(DATA_ROOT, "hooks");
	396	+
	397	+ // Receives "<old> <new> <ref>" lines; refuses refs with a path component
	398	+ // starting with "-", which git commands could mistake for options.
	399	+ const PRE_RECEIVE_HOOK = `#!/bin/sh
	400	+ status=0
	401	+ while read -r old new ref; do
	402	+ case "/$ref" in
	403	+ /-) echo "Vectrum: refusing $ref (ref name components must not start with '-')" >&2; status=1 ;;
	404	+ esac
	405	+ done
	406	+ exit $status
	407	+ `;
	408	+
	409	+ let hooksInstalled = false;
	410	+
	411	+ /** Server-side hooks for every repository, (re)written once per process so updates apply. */
	412	+ function hooksDir() {
	413	+ if (!hooksInstalled) {
	414	+ mkdirSync(HOOKS_DIR, { recursive: true });
	415	+ writeFileSync(path.join(HOOKS_DIR, "pre-receive"), PRE_RECEIVE_HOOK, { mode: 0o755 });
	416	+ hooksInstalled = true;
	417	+ }
	418	+ return HOOKS_DIR;
	419	+ }
	420	+
	421	+ /**
	422	+ * Starts upload-pack or receive-pack for a transport. HTTP uses stateless RPC;
	423	+ * SSH streams a whole session. Pushes always run Vectrum's hooks, whatever the
	424	+ * repository's own hook configuration.
	425	+ */
372	426	export function spawnService(
373	427	service: GitService,
374	428	dir: string,
375		- opts: { advertise?: boolean; protocol?: string \| null } = {},
	429	+ opts: { stateless?: boolean; advertise?: boolean; protocol?: string \| null } = {},
376	430	) {
377		- const args = [service.slice(4), "--stateless-rpc"];
	431	+ const args = service === "git-receive-pack" ? ["-c", `core.hooksPath=${hooksDir()}`] : [];
	432	+ args.push(service.slice(4));
	433	+ if (opts.stateless ?? true) args.push("--stateless-rpc");
378	434	if (opts.advertise) args.push("--advertise-refs");
379	435	args.push(dir);
380	436	return spawn("git", args, {

+3−5lib/repo.tsView File

@@ -1,10 +1,10 @@
1	1	import "server-only";
2	2	import { cache } from "react";
3		- import { headers } from "next/headers";
4	3	import { forbidden, notFound } from "next/navigation";
5	4	import { getViewer } from "./auth";
6	5	import { defaultBranch, isBranch, normalizeRepoName, resolveRefAndPath } from "./git";
7	6	import { canWrite, findRepo, repoAccess, type RepoRecord } from "./repos";
	7	+ import { serverHost, serverOrigin } from "./request-origin";
8	8	import { sshCloneUrl } from "./ssh-config";
9	9
10	10	/**
@@ -59,11 +59,9 @@ export async function getBranchAndPath(repo: Repo, segments: string[]) {
59	59	}
60	60
61	61	export async function cloneUrls(repo: RepoRecord) {
62		- const h = await headers();
63		- const host = h.get("x-forwarded-host") ?? h.get("host") ?? "localhost:3000";
64		- const proto = h.get("x-forwarded-proto") ?? "http";
	62	+ const [origin, host] = await Promise.all([serverOrigin(), serverHost()]);
65	63	return {
66		- https: `${proto}://${host}/${repo.owner}/${repo.name}.git`,
	64	+ https: `${origin}/${repo.owner}/${repo.name}.git`,
67	65	ssh: sshCloneUrl(host, `${repo.owner}/${repo.name}.git`),
68	66	};
69	67	}

+21−0lib/request-origin.tsaddedView File

++ import "server-only";
++ import { headers } from "next/headers";
++ // Host and X-Forwarded-* headers are client-controlled, so the canonical
++ // address comes from configuration. Without PUBLIC_URL (local development),
++ // URLs fall back to the request's Host header over plain HTTP.
++ const PUBLIC_URL = process.env.PUBLIC_URL ? new URL(process.env.PUBLIC_URL) : null;
++ /** Session cookies are marked Secure when the instance is served over HTTPS (or SECURE_COOKIES=1). */
++ export const SECURE_COOKIES = process.env.SECURE_COOKIES === "1" || PUBLIC_URL?.protocol === "https:";
++ /** The address users reach this server at, e.g. https://vectrum.cc. */
++ export async function serverOrigin() {
++   if (PUBLIC_URL) return PUBLIC_URL.origin;
++   return `http://${(await headers()).get("host") ?? "localhost:3000"}`;
++ }
++ /** Host (and port) part of serverOrigin(), e.g. vectrum.cc. */
++ export async function serverHost() {
++   return new URL(await serverOrigin()).host;
++ }

+5−3lib/ssh-server.tsView File

@@ -1,8 +1,7 @@
1		- import { spawn } from "node:child_process";
2	1	import { readFileSync, writeFileSync, existsSync, mkdirSync } from "node:fs";
3	2	import path from "node:path";
4	3	import { Server, utils, type Connection } from "ssh2";
5		- import { normalizeRepoName } from "./git";
	4	+ import { normalizeRepoName, spawnService } from "./git";
6	5	import { findKeyByBlob, touchSshKey } from "./keys";
7	6	import { DATA_ROOT } from "./paths";
8	7	import { canWrite, findRepo, markPushed, repoAccess } from "./repos";
@@ -83,7 +82,10 @@ function handleConnection(client: Connection) {
83	82	return fail(`Permission to ${repo.owner}/${repo.name} denied to ${user.username}.`);
84	83	}
85	84
86		- const child = spawn("git", [service, repo.dir], { env: { ...process.env, ...env } });
	85	+ const child = spawnService(pushing ? "git-receive-pack" : "git-upload-pack", repo.dir, {
	86	+ stateless: false,
	87	+ protocol: env.GIT_PROTOCOL,
	88	+ });
87	89	channel.pipe(child.stdin);
88	90	child.stdout.pipe(channel, { end: false });
89	91	child.stderr.pipe(channel.stderr, { end: false });

+6−2package.jsonView File

@@ -6,7 +6,8 @@
6	6	"dev": "next dev",
7	7	"build": "next build",
8	8	"start": "next start",
9		- "lint": "eslint"
	9	+ "lint": "eslint",
	10	+ "test": "bun test"
10	11	},
11	12	"dependencies": {
12	13	"@codemirror/language": "^6.12.4",
@@ -46,5 +47,8 @@
46	47	"trustedDependencies": [
47	48	"sharp",
48	49	"unrs-resolver"
49		- ]
	50	+ ],
	51	+ "patchedDependencies": {
	52	+ "ssh2@1.17.0": "patches/ssh2@1.17.0.patch"
	53	+ }
50	54	}

+283−0patches/ssh2@1.17.0.patchaddedView File

++ diff --git a/lib/protocol/constants.js b/lib/protocol/constants.js
++ index ad7759257d6bdbcafa353dec8946258d64c14eb0..6fb70b8720f6d7cf8ae3692a0fa14fbeb35eb16f 100644
++ --- a/lib/protocol/constants.js
++ +++ b/lib/protocol/constants.js
++ @@ -32,6 +32,29 @@ const curve25519Supported = (typeof crypto.diffieHellman === 'function'
++                               && typeof crypto.generateKeyPairSync === 'function'
++                               && typeof crypto.createPublicKey === 'function');
++ +const mlkemSupported = (() => {
++ +  try {
++ +    if (!curve25519Supported
++ +        || typeof crypto.encapsulate !== 'function'
++ +        || typeof crypto.decapsulate !== 'function') {
++ +      return false;
++ +    }
++ +    const keys = crypto.generateKeyPairSync('ml-kem-768');
++ +    const { ciphertext } = crypto.encapsulate(
++ +      keys.publicKey
++ +    );
++ +
++ +    crypto.decapsulate(
++ +      keys.privateKey,
++ +      ciphertext
++ +    );
++ +
++ +    return true;
++ +  } catch {
++ +    return false;
++ +  }
++ +})();
++ +
++  const DEFAULT_KEX = [
++    // https://tools.ietf.org/html/rfc5656#section-10.1
++    'ecdh-sha2-nistp256',
++ @@ -52,6 +75,11 @@ if (curve25519Supported) {
++    DEFAULT_KEX.unshift('curve25519-sha256');
++    DEFAULT_KEX.unshift('curve25519-sha256@libssh.org');
++  }
++ +
++ +if (mlkemSupported)
++ +  DEFAULT_KEX.unshift('mlkem768x25519-sha256');
++ +
++ +
++  const SUPPORTED_KEX = DEFAULT_KEX.concat([
++    // https://tools.ietf.org/html/rfc4419#section-4
++    'diffie-hellman-group-exchange-sha1',
++ @@ -189,6 +217,9 @@ module.exports = {
++      KEXECDH_INIT: 30,
++      KEXECDH_REPLY: 31,
++ +    KEX_HYBRID_INIT: 30,
++ +    KEX_HYBRID_REPLY: 31,
++ +
++      // User auth protocol -- generic (50-59)
++      USERAUTH_REQUEST: 50,
++      USERAUTH_FAILURE: 51,
++ @@ -349,6 +380,7 @@ module.exports = {
++    curve25519Supported,
++    eddsaSupported,
++ +  mlkemSupported,
++  };
++  module.exports.DISCONNECT_REASON_BY_VALUE =
++ diff --git a/lib/protocol/kex.js b/lib/protocol/kex.js
++ index 811e631b8ab78d32776e540919d25aae56d628f7..75252c5632c55ae7b9f86cc58011a64254742a2e 100644
++ --- a/lib/protocol/kex.js
++ +++ b/lib/protocol/kex.js
++ @@ -6,7 +6,9 @@ const {
++    createECDH,
++    createHash,
++    createPublicKey,
++ +  decapsulate,
++    diffieHellman,
++ +  encapsulate,
++    generateKeyPairSync,
++    randomFillSync,
++  } = require('crypto');
++ @@ -23,6 +25,7 @@ const {
++    DEFAULT_COMPRESSION,
++    DISCONNECT_REASON,
++    MESSAGE,
++ +  mlkemSupported,
++  } = require('./constants.js');
++  const {
++    CIPHER_INFO,
++ @@ -1580,6 +1583,184 @@ const createKeyExchange = (() => {
++      }
++    }
++ +  class MLKEMx25519Exchange extends KeyExchange {
++ +    // NOTE: based on the following draft
++ +    // https://datatracker.ietf.org/doc/html/draft-ietf-sshm-mlkem-hybrid-kex-03.html
++ +    constructor(hashName, ...args) {
++ +      super(...args);
++ +
++ +      this.type = 'mlkem768x25519';
++ +      this.hashName = hashName;
++ +
++ +      this._x25519Keys = null;
++ +      this._mlkemKeys = null;
++ +
++ +      this._S_CT2 = null; // needed for server
++ +    }
++ +
++ +    generateKeys() {
++ +      if (!this._x25519Keys)
++ +        this._x25519Keys = generateKeyPairSync('x25519');
++ +
++ +      if (!this._mlkemKeys)
++ +        this._mlkemKeys = generateKeyPairSync('ml-kem-768');
++ +    }
++ +
++ +    convertPublicKey(key) {
++ +      // We need to override this because the key
++ +      // is not an mpint (compare section 2.1 on the draft
++ +      // to section 8 on rfc4253)
++ +      return key;
++ +    }
++ +
++ +    getPublicKey() {
++ +      this.generateKeys();
++ +
++ +      const isServer = this._protocol._server;
++ +
++ +      if (!isServer) {
++ +        // client
++ +        const C_PK1 = this._x25519Keys.publicKey
++ +          .export({ type: 'spki', format: 'der' })
++ +          .slice(-32);
++ +
++ +        const C_PK2 = this._mlkemKeys.publicKey
++ +          .export({ type: 'spki', format: 'der' })
++ +          .slice(-1184);
++ +
++ +        return Buffer.concat([C_PK2, C_PK1]);
++ +      }
++ +
++ +      // server
++ +
++ +      // NOTE: S_CT2 should already have been
++ +      // calculated by now, since client is the
++ +      // one that initiates the kex
++ +      const S_PK1 = this._x25519Keys.publicKey
++ +        .export({ type: 'spki', format: 'der' })
++ +        .slice(-32);
++ +
++ +      return Buffer.concat([this._S_CT2, S_PK1]);
++ +    }
++ +
++ +    buildX25519SPKI(key) {
++ +      const asnWriter = new Ber.Writer();
++ +      asnWriter.startSequence();
++ +      // algorithm
++ +      asnWriter.startSequence();
++ +      asnWriter.writeOID('1.3.101.110'); // id-X25519
++ +      asnWriter.endSequence();
++ +
++ +      // PublicKey
++ +      asnWriter.startSequence(Ber.BitString);
++ +      asnWriter.writeByte(0x00);
++ +      // XXX: hack to write a raw buffer without a tag -- yuck
++ +      asnWriter._ensure(key.length);
++ +      key.copy(
++ +        asnWriter._buf,
++ +        asnWriter._offset,
++ +        0,
++ +        key.length
++ +      );
++ +      asnWriter._offset += key.length;
++ +      asnWriter.endSequence();
++ +      asnWriter.endSequence();
++ +
++ +      return asnWriter;
++ +    }
++ +
++ +    computeSecret(otherPublicKey) {
++ +      try {
++ +        this.generateKeys();
++ +        const isServer = this._protocol._server;
++ +        if (isServer && !this._S_CT2) {
++ +          // server
++ +          const C_PK2 = otherPublicKey.slice(0, 1184);
++ +          const C_PK1 = otherPublicKey.slice(1184);
++ +
++ +          if (C_PK1.length !== 32) {
++ +            const got = C_PK1.length;
++ +            throw new Error(
++ +              `Invalid C_PK1 length: expected 32, got ${got}`
++ +            );
++ +          }
++ +
++ +          const x25519SPKI = this.buildX25519SPKI(C_PK1);
++ +
++ +          const K_CL = diffieHellman({
++ +            privateKey: this._x25519Keys.privateKey,
++ +            publicKey: createPublicKey({
++ +              key: x25519SPKI.buffer,
++ +              type: 'spki',
++ +              format: 'der',
++ +            }),
++ +          });
++ +
++ +          const templateDER = this._mlkemKeys.publicKey
++ +            .export({ type: 'spki', format: 'der' });
++ +
++ +          const C_PK2_DER = Buffer.allocUnsafe(templateDER.length);
++ +
++ +          templateDER.copy(C_PK2_DER, 0, 0, templateDER.length - 1184);
++ +
++ +          C_PK2.copy(C_PK2_DER, templateDER.length - 1184);
++ +
++ +          const { sharedKey: K_PQ, ciphertext: S_CT2 } = encapsulate(
++ +            createPublicKey({
++ +              key: C_PK2_DER,
++ +              type: 'spki',
++ +              format: 'der',
++ +            })
++ +          );
++ +
++ +          this._S_CT2 = S_CT2;
++ +
++ +          // K = HASH(K_PQ || K_CL) from 2.4 on draft
++ +          const K = createHash('sha256')
++ +            .update(K_PQ)
++ +            .update(K_CL)
++ +            .digest();
++ +
++ +          return K;
++ +        }
++ +        // client
++ +        const S_CT2 = otherPublicKey.slice(0, 1088);
++ +        const S_PK1 = otherPublicKey.slice(1088);
++ +
++ +        if (S_PK1.length !== 32) {
++ +          const got = S_PK1.length;
++ +          throw new Error(
++ +            `Invalid S_PK1 length: expected 32, got ${got}`
++ +          );
++ +        }
++ +
++ +        const x25519SPKI = this.buildX25519SPKI(S_PK1);
++ +
++ +        const K_CL = diffieHellman({
++ +          privateKey: this._x25519Keys.privateKey,
++ +          publicKey: createPublicKey({
++ +            key: x25519SPKI.buffer,
++ +            type: 'spki',
++ +            format: 'der',
++ +          }),
++ +        });
++ +
++ +        const K_PQ = decapsulate(this._mlkemKeys.privateKey, S_CT2);
++ +
++ +        // K = HASH(K_PQ || K_CL) from 2.4 on draft
++ +        const K = createHash('sha256')
++ +          .update(K_PQ)
++ +          .update(K_CL)
++ +          .digest();
++ +
++ +        return K;
++ +
++ +      } catch (error) {
++ +        return error;
++ +      }
++ +    }
++ +  }
++ +
++    return (negotiated, ...args) => {
++      if (typeof negotiated !== 'object' || negotiated === null)
++        throw new Error('Invalid negotiated argument');
++ @@ -1587,6 +1768,11 @@ const createKeyExchange = (() => {
++      if (typeof kexType === 'string') {
++        args = [negotiated, ...args];
++        switch (kexType) {
++ +        case 'mlkem768x25519-sha256':
++ +          if (!mlkemSupported)
++ +            break;
++ +          return new MLKEMx25519Exchange('sha256', ...args);
++ +
++          case 'curve25519-sha256':
++          case 'curve25519-sha256@libssh.org':
++            if (!curve25519Supported)