Summary
In crates/gitlawb-node/src/sync.rs:243-245 and crates/gitlawb-node/src/api/peers.rs:352-383, process_batch uses item.node_did solely to query resolve_origin_url. It does not verify that node_did matches the repository's recorded origin or owner DID.
Impact
As noted in PR #274's residuals, a well-formed slug matching an existing local mirror allows any known peer to enqueue a sync, repointing remote.origin and overwriting refs through the mirror refspec.
Remediation
- Verify that
item.node_did matches the repository's recorded origin DID before triggering fetch_repo.
- Reject sync notifications where the notifying peer is not authorized for the repository slug.
Summary
In
crates/gitlawb-node/src/sync.rs:243-245andcrates/gitlawb-node/src/api/peers.rs:352-383,process_batchusesitem.node_didsolely to queryresolve_origin_url. It does not verify thatnode_didmatches the repository's recorded origin or owner DID.Impact
As noted in PR #274's residuals, a well-formed slug matching an existing local mirror allows any known peer to enqueue a sync, repointing
remote.originand overwriting refs through the mirror refspec.Remediation
item.node_didmatches the repository's recorded origin DID before triggeringfetch_repo.