feat: add baseUrl to github provider to support github enterprise urls - #4944
feat: add baseUrl to github provider to support github enterprise urls#4944narcisonunez wants to merge 1 commit into
Conversation
dosubot
Bot
added
size:L
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
| if ("error" in parsed) { | ||
| return res.status(400).json({ error: parsed.error }); | ||
| } | ||
|
|
There was a problem hiding this comment.
When a user with Git-provider creation permission supplies an internally resolving HTTPS FQDN in githubUrl, the callback uses that host for Octokit's manifest-conversion POST, allowing blind requests to internal HTTPS services with redirect, error, and timing outcomes visible to the caller.
How this was verified: The callback passes the accepted query hostname directly to Octokit's manifest-conversion request while validation permits arbitrary fully qualified DNS names.
| githubInstallationId: text("githubInstallationId"), | ||
| githubPrivateKey: text("githubPrivateKey"), | ||
| githubWebhookSecret: text("githubWebhookSecret"), | ||
| githubUrl: text("githubUrl").default("https://github.com").notNull(), |
There was a problem hiding this comment.
Small thing, is there a reason we default to https://github.com here? Heads up in case you hadn't seen it: providers/github.ts already checks host === "github.com" and returns the API URL, so this ends up being derived twice. I think we could default straight to https://api.github.com and drop the guessing in deriveGithubApiUrl
There was a problem hiding this comment.
@Siumauricio You are right. However, I used https://github.com as default because githubUrl represents the base url. This keeps consistency because we save the base url for the enterprise url.
Do you want me to replace it?
2 participants
What is this PR about?
Adds support for github enterprise instances. Currently, we only support github.com and it was hardcoded in the code base.
Checklist
Before submitting this PR, please make sure that:
canarybranch.Issues related (if applicable)
No related issue.
Screenshots (if applicable)
Greptile Summary
Adds configurable GitHub instance URLs for GitHub Enterprise support.
Confidence Score: 4/5
This PR should not merge until the setup callback prevents request-controlled GitHub hosts from targeting internal network services.
The callback uses an authenticated user's githubUrl query parameter as the destination of a server-side POST, while validation still permits private DNS names and hostnames that resolve to private addresses.
Files Needing Attention: apps/dokploy/pages/api/providers/github/setup.ts and packages/server/src/utils/providers/github.ts
Security Review
The setup callback permits authenticated blind SSRF because its query-controlled GitHub URL can resolve to an internal HTTPS service. How this was verified: The callback passes the accepted query hostname directly to Octokit's manifest-conversion request while validation allows arbitrary fully qualified DNS names.
Reviews (1): Last reviewed commit: "feat: add baseUrl to github provider to ..." | Re-trigger Greptile