security: add IP-level SSRF defense for action.yml Gitea path #123

New Issue

2026-05-14T04:29:07Z

rodin commented

2026-05-14 04:29:07 +00:00

Context

From security review on PR #121 (finding #3 MINOR):

SSRF risk: Allowing inputs.gitea-url and action-repo to control request destinations without validation enables server-side requests to arbitrary/internal addresses from the runner environment. Even without tokens, this can be abused on self-hosted runners to access internal services.

Current State (after PR #121 fix)

URL scheme is validated (https:// only)
Whitespace/newlines are rejected
Token exfiltration is prevented (GitHub path ignores user URLs entirely)

What remains

DNS resolution + IP validation to block private/link-local/loopback addresses
Preventing DNS rebinding attacks
Blocking non-standard ports
Preventing redirects to untrusted hosts

Challenge

These defenses are complex in pure bash. Options:

Add a Go helper binary (review-bot validate-url) that performs DNS resolution and IP checks
Use dig/getent hosts + IP range checks in bash (fragile, platform-dependent)
Accept the residual risk with documentation (Gitea tokens are the user's own; the attack requires controlling workflow inputs on their own runner)

Acceptance Criteria

Decide on approach
Implement URL validation that blocks requests to RFC1918/loopback/link-local IPs
Block HTTP redirects to non-https or different hosts
Add tests

## Context From security review on PR #121 (finding #3 MINOR): > SSRF risk: Allowing inputs.gitea-url and action-repo to control request destinations without validation enables server-side requests to arbitrary/internal addresses from the runner environment. Even without tokens, this can be abused on self-hosted runners to access internal services. ## Current State (after PR #121 fix) - URL scheme is validated (https:// only) - Whitespace/newlines are rejected - Token exfiltration is prevented (GitHub path ignores user URLs entirely) ## What remains - DNS resolution + IP validation to block private/link-local/loopback addresses - Preventing DNS rebinding attacks - Blocking non-standard ports - Preventing redirects to untrusted hosts ## Challenge These defenses are complex in pure bash. Options: 1. Add a Go helper binary (`review-bot validate-url`) that performs DNS resolution and IP checks 2. Use `dig`/`getent hosts` + IP range checks in bash (fragile, platform-dependent) 3. Accept the residual risk with documentation (Gitea tokens are the user's own; the attack requires controlling workflow inputs on their own runner) ## Acceptance Criteria - [ ] Decide on approach - [ ] Implement URL validation that blocks requests to RFC1918/loopback/link-local IPs - [ ] Block HTTP redirects to non-https or different hosts - [ ] Add tests

rodin referenced this issue from a commit

2026-05-14 04:29:20 +00:00

fix(action): address security review - prevent token exfiltration and add input validation

rodin referenced this issue

2026-05-14 04:30:20 +00:00

fix(action): detect VCS host type for version resolution and binary download #121

rodin referenced this issue from a commit

2026-05-14 07:38:34 +00:00

feat(#123): add IP-level SSRF defense to Gitea client and action

rodin referenced this issue from a commit

2026-05-14 07:44:12 +00:00

feat(#123): add IP-level SSRF defense to Gitea client and action