Skip to content

Enforce leading-slash requirement on path parameters in ArtifactoryImpl - #456

Merged
fluxxBot merged 5 commits into
devfrom
RTECO-2308
Sep 17, 2026
Merged

fluxxBot merged 5 commits into
devfrom
RTECO-2308

Conversation

@fluxxBot

@fluxxBot fluxxBot commented Sep 16, 2026

Copy link
Copy Markdown
  • All tests passed. If this feature is not already covered by the tests, I added new tests.
  • This pull request is on the dev branch.

Summary

  • Centralizes URI construction in ArtifactoryImpl behind a single buildUri(String path) helper
  • buildUri validates that path starts with / before concatenating with the configured base URL, throwing IllegalArgumentException for invalid input
  • Replaces seven independent URI.create(url + path) call sites (get, head, post, put, patch, delete, handleArtifactoryRequest) with the shared helper
  • Adds unit test atPrefixedPathMustBeRejected covering malformed paths and confirming valid paths are unaffected

Also in this PR

  • Fix CargoPackageTypeRepositoryTests: drop cargoInternalIndex and gitRegistryUrl from test settings — Artifactory 7.46.3 removed legacy Git index support for all Cargo repo types; sparse HTTP index is now the only accepted mode
  • Fix CI workflow: add shell: bash to "Wait for Artifactory" and "Cleanup test repositories" steps so they run correctly on Windows runners; skip Artifactory-dependent steps on macOS where the local install does not start reliably

@fluxxBot fluxxBot added the bug Something isn't working label Sep 16, 2026
@github-actions

github-actions Bot commented Sep 16, 2026

Copy link
Copy Markdown

CLA Assistant Lite bot All contributors have signed the CLA ✍️ ✅

@fluxxBot fluxxBot added the safe to test Approve running integration tests on a pull request label Sep 16, 2026
@github-actions github-actions Bot removed the safe to test Approve running integration tests on a pull request label Sep 16, 2026
@fluxxBot fluxxBot changed the title Rteco 2308 Reject paths not starting with '/' to prevent SSRF Sep 16, 2026
@fluxxBot fluxxBot added the safe to test Approve running integration tests on a pull request label Sep 17, 2026
@github-actions github-actions Bot removed the safe to test Approve running integration tests on a pull request label Sep 17, 2026
@fluxxBot fluxxBot added the safe to test Approve running integration tests on a pull request label Sep 17, 2026
@github-actions github-actions Bot removed the safe to test Approve running integration tests on a pull request label Sep 17, 2026
@fluxxBot
fluxxBot merged commit 334378f into dev Sep 17, 2026
4 checks passed
@fluxxBot fluxxBot changed the title Reject paths not starting with '/' to prevent SSRF Enforce leading-slash requirement on path parameters in ArtifactoryImpl Sep 18, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

bug Something isn't working

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants