fix(pr-merge): harden provider message path

2026-08-06 00:10:48 -05:00
parent 1ceb11058f
commit 113bac9e7c
3 changed files with 143 additions and 56 deletions
@@ -178,6 +178,20 @@ else:
 LAST_GITEA_HTTP_CODE="000"
 LAST_GITEA_ERROR=""
 MERGE_TEMP_DIRS=()
+GITEA_CURL_MAX_BYTES="${MOSAIC_GITEA_CURL_MAX_BYTES:-1048576}"
+GITEA_CURL_MAX_TIME="${MOSAIC_GITEA_CURL_MAX_TIME_SEC:-30}"
+GITEA_CURL_CONNECT_TIMEOUT="${MOSAIC_GITEA_CURL_CONNECT_TIMEOUT_SEC:-10}"
+for bound in "$GITEA_CURL_MAX_BYTES" "$GITEA_CURL_MAX_TIME" "$GITEA_CURL_CONNECT_TIMEOUT"; do
+    if [[ ! "$bound" =~ ^[1-9][0-9]*$ ]]; then
+        echo "Error: Gitea curl bounds must be positive integers; refusing request." >&2
+        exit 1
+    fi
+done
+GITEA_CURL_BOUNDS=(
+    --max-filesize "$GITEA_CURL_MAX_BYTES"
+    --max-time "$GITEA_CURL_MAX_TIME"
+    --connect-timeout "$GITEA_CURL_CONNECT_TIMEOUT"
+)

 format_gitea_error_response() {
    local response_file="$1"
@@ -219,7 +233,7 @@ trap 'exit 143' TERM

 fetch_gitea_pr_head() {
    local host="$1" auth_mode="$2" credential="$3" work_root="$4"
-    local response_file raw_code api_url auth_config
+    local response_file raw_code api_url auth_config curl_rc
    response_file=$(mktemp "$work_root/pr-merge-pr.XXXXXX")
    api_url="https://${host}/api/v1/repos/${OWNER}/${REPO}/pulls/${PR_NUMBER}"
    if ! auth_config=$(write_curl_auth_config "$auth_mode" "$credential"); then
@@ -227,10 +241,15 @@ fetch_gitea_pr_head() {
        rm -f "$response_file"
        return 1
    fi
-    raw_code=$(printf '%s\n' "$auth_config" | \
-        curl -sS -K - -w '%{http_code}' -o "$response_file" \
-            -H "User-Agent: curl/8" "$api_url" || true)
+    raw_code=$(curl -sS -K - "${GITEA_CURL_BOUNDS[@]}" -w '%{http_code}' -o "$response_file" \
+        -H "User-Agent: curl/8" "$api_url" <<<"$auth_config")
+    curl_rc=$?
    LAST_GITEA_HTTP_CODE="${raw_code:-000}"
+    if [[ "$curl_rc" -ne 0 ]]; then
+        LAST_GITEA_ERROR="curl transport failed (rc=$curl_rc)"
+        rm -f "$response_file"
+        return 1
+    fi
    if [[ ! "$raw_code" =~ ^2 ]]; then
        LAST_GITEA_ERROR=$(format_gitea_error_response "$response_file")
        rm -f "$response_file"
@@ -259,7 +278,7 @@ PY

 fetch_gitea_pr_commits() {
    local host="$1" auth_mode="$2" credential="$3" work_root="$4"
-    local page page_file combined_file merged_file raw_code page_count api_url auth_config
+    local page page_file combined_file merged_file raw_code page_count api_url auth_config curl_rc
    mkdir -p "$work_root"
    if ! auth_config=$(write_curl_auth_config "$auth_mode" "$credential"); then
        echo "Error: Could not construct Gitea authentication config; refusing request." >&2
@@ -272,10 +291,15 @@ fetch_gitea_pr_commits() {
    while true; do
        page_file=$(mktemp "$work_root/pr-merge-commits-page.XXXXXX")
        api_url="https://${host}/api/v1/repos/${OWNER}/${REPO}/pulls/${PR_NUMBER}/commits?limit=50&page=${page}"
-        raw_code=$(printf '%s\n' "$auth_config" | \
-            curl -sS -K - -w '%{http_code}' -o "$page_file" \
-                -H "User-Agent: curl/8" "$api_url" || true)
+        raw_code=$(curl -sS -K - "${GITEA_CURL_BOUNDS[@]}" -w '%{http_code}' -o "$page_file" \
+            -H "User-Agent: curl/8" "$api_url" <<<"$auth_config")
+        curl_rc=$?
        LAST_GITEA_HTTP_CODE="${raw_code:-000}"
+        if [[ "$curl_rc" -ne 0 ]]; then
+            LAST_GITEA_ERROR="curl transport failed (rc=$curl_rc)"
+            rm -f "$page_file" "$combined_file"
+            return 1
+        fi
        if [[ ! "$raw_code" =~ ^2 ]]; then
            LAST_GITEA_ERROR=$(format_gitea_error_response "$page_file")
            rm -f "$page_file" "$combined_file"
@@ -399,7 +423,12 @@ for item in commits:
            file=sys.stderr,
        )
        raise SystemExit(75)
-    if not re.fullmatch(r"[A-Za-z0-9_.-]+", login) or not re.fullmatch(r"[^<>\s]+@[^<>\s]+", email):
+    if (
+        not email.isascii()
+        or not email.isprintable()
+        or not re.fullmatch(r"[A-Za-z0-9_.-]+", login)
+        or not re.fullmatch(r"[^<>\s]+@[^<>\s]+", email)
+    ):
        print(
            f"BLOCK: commit {sha!r} has unusable linked identity "
            f"author.login={login!r}, commit.author.email={email!r}; refusing merge; "
@@ -445,7 +474,7 @@ PY

 merge_gitea_api_attempt() {
    local host="$1" auth_mode="$2" credential="$3"
-    local api_url attempt_dir body_file raw_code commits_file fields_file context_file head_file payload_file work_root attempt_rc auth_config
+    local api_url attempt_dir body_file raw_code commits_file fields_file context_file head_file payload_file work_root attempt_rc auth_config curl_rc
    LAST_GITEA_HTTP_CODE="000"
    LAST_GITEA_ERROR=""
    api_url="https://${host}/api/v1/repos/${OWNER}/${REPO}/pulls/${PR_NUMBER}/merge"
@@ -520,12 +549,18 @@ PY
        rm -f "$body_file" "$payload_file"
        return 1
    fi
-    raw_code=$(printf '%s\n' "$auth_config" | \
-        curl -sS -K - -w '%{http_code}' -o "$body_file" \
-            -X POST -H "User-Agent: curl/8" \
-            -H 'Content-Type: application/json' \
-            --data-binary "@$payload_file" "$api_url" || true)
+    raw_code=$(curl -sS -K - "${GITEA_CURL_BOUNDS[@]}" -w '%{http_code}' -o "$body_file" \
+        -X POST -H "User-Agent: curl/8" \
+        -H 'Content-Type: application/json' \
+        --data-binary "@$payload_file" "$api_url" <<<"$auth_config")
+    curl_rc=$?
    LAST_GITEA_HTTP_CODE="${raw_code:-000}"
+    if [[ "$curl_rc" -ne 0 ]]; then
+        LAST_GITEA_ERROR="curl transport failed (rc=$curl_rc)"
+        rm -f "$body_file" "$payload_file"
+        rm -rf -- "$attempt_dir"
+        return 1
+    fi
    if [[ ! "$raw_code" =~ ^2 ]]; then
        LAST_GITEA_ERROR=$(format_gitea_error_response "$body_file")
    fi
@@ -535,7 +570,7 @@ PY
 }

 merge_gitea_with_api() {
-    local host="$1" token basic_auth attempt_rc
+    local host="$1" token attempt_rc

    if ! token=$(get_gitea_token "$host"); then
        echo "Error: Could not resolve the required Gitea token; refusing merge without changing principals." >&2
@@ -554,28 +589,10 @@ merge_gitea_with_api() {
        return 75
    fi
    if [[ "$LAST_GITEA_HTTP_CODE" != "401" ]]; then
-        echo "Error: Gitea API merge failed with token credential (HTTP ${LAST_GITEA_HTTP_CODE:-000}).${LAST_GITEA_ERROR:+ Provider response: $LAST_GITEA_ERROR} Basic Auth fallback is allowed only after HTTP 401." >&2
+        echo "Error: Gitea API merge failed with the identity-bound token (HTTP ${LAST_GITEA_HTTP_CODE:-000}).${LAST_GITEA_ERROR:+ Provider response: $LAST_GITEA_ERROR}" >&2
        return 1
    fi
-    echo "Token credential received HTTP 401; retrying inspection and merge with configured Basic Auth." >&2
-
-    basic_auth=$(get_gitea_basic_auth "$host" || true)
-    if [[ -n "$basic_auth" ]]; then
-        if merge_gitea_api_attempt "$host" basic "$basic_auth"; then
-            return 0
-        else
-            attempt_rc=$?
-        fi
-        if [[ "$attempt_rc" -eq 75 ]]; then
-            return 75
-        fi
-    fi
-
-    if [[ -z "$token" && -z "$basic_auth" ]]; then
-        echo "Error: No Gitea credential is available for the merge operation." >&2
-    else
-        echo "Error: Gitea API merge failed for all configured credentials (last HTTP ${LAST_GITEA_HTTP_CODE:-000}).${LAST_GITEA_ERROR:+ Provider response: $LAST_GITEA_ERROR}" >&2
-    fi
+    echo "Error: Gitea API rejected the identity-bound token with HTTP 401; refusing cross-principal credential fallback." >&2
    return 1
 }