Skip to content

sync: Missing origin-ownership check allows known peer to force-fetch into existing mirror #432

Description

@euxaristia

Summary

In crates/gitlawb-node/src/sync.rs:243-245 and crates/gitlawb-node/src/api/peers.rs:352-383, process_batch uses item.node_did solely to query resolve_origin_url. It does not verify that node_did matches the repository's recorded origin or owner DID.

Impact

As noted in PR #274's residuals, a well-formed slug matching an existing local mirror allows any known peer to enqueue a sync, repointing remote.origin and overwriting refs through the mirror refspec.

Remediation

  1. Verify that item.node_did matches the repository's recorded origin DID before triggering fetch_repo.
  2. Reject sync notifications where the notifying peer is not authorized for the repository slug.

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    crate:nodegitlawb-node — the serving node and REST APIkind:securityVulnerability fix or hardeningsev:highMajor break or real security/trust risk, no easy workaroundsubsystem:apiNode REST API request/response surfacesubsystem:peersPeer announce, discovery, and registrysubsystem:replicationMirror, replica, and cross-node sync

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions