feat: enhance repository connection error handling and add public address resolution by CasLubbers · Pull Request #1114 · linode/apl-api

CasLubbers · 2026-10-09T13:10:26Z

No description provided.

…ress resolution Signed-off-by: Cas Lubbers <clubbers@akamai.com>

Copilot

🟡 Changes recommended

DNS-rebinding and IPv6 bypasses undermine the protection, while raw Git errors may leak credentials.

4 open findings

Sanitize Git errors before logging credentials · New
IPv6 classifier allows private and mapped loopback addresses · New
DNS rebinding bypasses SSRF validation · New
Add deterministic tests for DNS security validation · New

What changed in this PR

Adds repository SSRF protections and standardizes connection failure responses.

Changes:

Rejects repository hosts resolving to restricted addresses.
Disables Git HTTP redirects.
Returns generic connection errors while logging details.

File	Description
`src/utils/codeRepoUtils.ts`	Adds DNS address validation and redirect protection.
`src/otomi-stack.ts`	Standardizes repository connection errors.

🧠 Review effort: Balanced

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

+    const hostname = isSSH
+      ? normalizedUrl.slice('git@'.length, normalizedUrl.indexOf(':'))
+      : new URL(normalizedUrl).hostname
+    await assertResolvesToPublicAddress(hostname)


+export async function assertResolvesToPublicAddress(hostname: string): Promise<void> {
+  let addresses: { address: string; family: number }[]
+  try {
+    addresses = await lookup(hostname, { all: true })


Signed-off-by: Cas Lubbers <clubbers@akamai.com>

Copilot

🔵 Needs a closer look

The address validation remains vulnerable to DNS rebinding and incompletely handles IPv6 and internal SSH repositories.

4 open findings

DNS rebinding bypasses SSRF validation
IPv6 classifier allows private and mapped loopback addresses
Sanitize Git errors before logging credentials
Add deterministic tests for DNS security validation

Previously missed (1)

In code that hasn't changed since last review

Recognize internal Gitea SSH URLs before private-IP rejection

src/utils/codeRepoUtils.ts:220

Internal Gitea SSH URLs regress here: isInternalGiteaUrl parses with new URL, so git@gitea.<domain>:org/repo.git is never recognized as internal and its private cluster address is rejected. getAuthenticatedGitClient explicitly supports SSH credentials, so derive the hostname first and apply the internal-host exemption independent of URL syntax.

🧠 Review effort: Balanced

…ress resolution Signed-off-by: Cas Lubbers <clubbers@akamai.com>

Copilot

🟡 Changes recommended

DNS rebinding can bypass the SSRF protection, and invalid CIDRs fail open.

4 open findings

DNS rebinding bypasses SSRF validation
Sanitize Git errors before logging credentials
Fail fast on invalid CIDR security configuration · New
Add deterministic tests for DNS security validation

1 resolved since last review

IPv6 classifier allows private and mapped loopback addresses

🧠 Review effort: Balanced

+// Fully admin-controlled via CODE_REPO_BLOCKED_CIDRS
+function isBlockedAddress(address: string): boolean {
+  const addr = ipaddr.process(address) // unwraps IPv4-mapped IPv6 (::ffff:a.b.c.d) to plain IPv4
+  return env.CODE_REPO_BLOCKED_CIDRS.split(',')
+    .map((cidr) => cidr.trim())
+    .filter(Boolean)
+    .some((cidr) => {
+      try {
+        const [rangeAddr, bits] = ipaddr.parseCIDR(cidr)
+        return addr.kind() === rangeAddr.kind() && addr.match(rangeAddr, bits)
+      } catch {
+        return false
+      }
+    })
+}


feat: enhance repository connection error handling and add public add…

a7b1b19

…ress resolution Signed-off-by: Cas Lubbers <clubbers@akamai.com>

Copilot AI balanced review requested due to automatic review settings October 9, 2026 13:10

CasLubbers requested review from dennisvankekem and ferruhcihan as code owners October 9, 2026 13:10

Copilot started reviewing on behalf of CasLubbers October 9, 2026 13:11 View session

Copilot AI reviewed Oct 9, 2026

View reviewed changes

fix: tests

51ef9c1

Signed-off-by: Cas Lubbers <clubbers@akamai.com>

Copilot AI balanced review requested due to automatic review settings October 9, 2026 13:32

Copilot started reviewing on behalf of CasLubbers October 9, 2026 13:32 View session

Copilot AI reviewed Oct 9, 2026

View reviewed changes

feat: enhance repository connection error handling and add public add…

909306d

…ress resolution Signed-off-by: Cas Lubbers <clubbers@akamai.com>

Copilot AI balanced review requested due to automatic review settings October 9, 2026 14:20

Copilot started reviewing on behalf of CasLubbers October 9, 2026 14:21 View session

Copilot AI reviewed Oct 9, 2026

View reviewed changes

Merge branch 'main' into APL-2112

040161b

Navigation Menu

Repository navigation

feat: enhance repository connection error handling and add public address resolution - #1114

feat: enhance repository connection error handling and add public address resolution#1114
CasLubbers wants to merge 4 commits into
mainfrom
APL-2112

CasLubbers commented Oct 9, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

CasLubbers commented Oct 9, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟡 Changes recommended

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🔵 Needs a closer look

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟡 Changes recommended

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants