|
| 1 | +From 60ef2bceba192c5bf9327d003bceea8bf1f8275f Mon Sep 17 00:00:00 2001 |
| 2 | +From: Hayden <8418760+Hayden-IO@users.noreply.github.com> |
| 3 | +Date: Wed, 21 Jan 2026 16:52:44 -0800 |
| 4 | +Subject: [PATCH] Drop support for fetching public keys by URL in the search |
| 5 | + index (#2731) |
| 6 | + |
| 7 | +This mitigates blind SSRF. Note that this API was marked as experimental |
| 8 | +so while this is a breaking change to the API, we offered no guarantee |
| 9 | +of stability. |
| 10 | + |
| 11 | +Fixes GHSA-4c4x-jm2x-pf9j |
| 12 | + |
| 13 | +Signed-off-by: Hayden <8418760+Hayden-IO@users.noreply.github.com> |
| 14 | + |
| 15 | +Upstream Patch reference: https://github.com/sigstore/rekor/commit/60ef2bceba192c5bf9327d003bceea8bf1f8275f.patch |
| 16 | +--- |
| 17 | + .../client/entries/entries_client.go | 2 +- |
| 18 | + .../pkg/generated/models/search_index.go | 20 ------------------- |
| 19 | + .../sigstore/rekor/pkg/util/fetch.go | 10 +++++++--- |
| 20 | + 3 files changed, 8 insertions(+), 24 deletions(-) |
| 21 | + |
| 22 | +diff --git a/vendor/github.com/sigstore/rekor/pkg/generated/client/entries/entries_client.go b/vendor/github.com/sigstore/rekor/pkg/generated/client/entries/entries_client.go |
| 23 | +index fe2630e..668ec29 100644 |
| 24 | +--- a/vendor/github.com/sigstore/rekor/pkg/generated/client/entries/entries_client.go |
| 25 | ++++ b/vendor/github.com/sigstore/rekor/pkg/generated/client/entries/entries_client.go |
| 26 | +@@ -58,7 +58,7 @@ type ClientService interface { |
| 27 | + /* |
| 28 | + CreateLogEntry creates an entry in the transparency log |
| 29 | + |
| 30 | +-Creates an entry in the transparency log for a detached signature, public key, and content. Items can be included in the request or fetched by the server when URLs are specified. |
| 31 | ++Creates an entry in the transparency log for a detached signature, public key, and content. |
| 32 | + */ |
| 33 | + func (a *Client) CreateLogEntry(params *CreateLogEntryParams, opts ...ClientOption) (*CreateLogEntryCreated, error) { |
| 34 | + // TODO: Validate the params before sending |
| 35 | +diff --git a/vendor/github.com/sigstore/rekor/pkg/generated/models/search_index.go b/vendor/github.com/sigstore/rekor/pkg/generated/models/search_index.go |
| 36 | +index bb1cccc..e731a3b 100644 |
| 37 | +--- a/vendor/github.com/sigstore/rekor/pkg/generated/models/search_index.go |
| 38 | ++++ b/vendor/github.com/sigstore/rekor/pkg/generated/models/search_index.go |
| 39 | +@@ -229,10 +229,6 @@ type SearchIndexPublicKey struct { |
| 40 | + // Required: true |
| 41 | + // Enum: [pgp x509 minisign ssh tuf] |
| 42 | + Format *string `json:"format"` |
| 43 | +- |
| 44 | +- // url |
| 45 | +- // Format: uri |
| 46 | +- URL strfmt.URI `json:"url,omitempty"` |
| 47 | + } |
| 48 | + |
| 49 | + // Validate validates this search index public key |
| 50 | +@@ -243,10 +239,6 @@ func (m *SearchIndexPublicKey) Validate(formats strfmt.Registry) error { |
| 51 | + res = append(res, err) |
| 52 | + } |
| 53 | + |
| 54 | +- if err := m.validateURL(formats); err != nil { |
| 55 | +- res = append(res, err) |
| 56 | +- } |
| 57 | +- |
| 58 | + if len(res) > 0 { |
| 59 | + return errors.CompositeValidationError(res...) |
| 60 | + } |
| 61 | +@@ -305,18 +297,6 @@ func (m *SearchIndexPublicKey) validateFormat(formats strfmt.Registry) error { |
| 62 | + return nil |
| 63 | + } |
| 64 | + |
| 65 | +-func (m *SearchIndexPublicKey) validateURL(formats strfmt.Registry) error { |
| 66 | +- if swag.IsZero(m.URL) { // not required |
| 67 | +- return nil |
| 68 | +- } |
| 69 | +- |
| 70 | +- if err := validate.FormatOf("publicKey"+"."+"url", "body", "uri", m.URL.String(), formats); err != nil { |
| 71 | +- return err |
| 72 | +- } |
| 73 | +- |
| 74 | +- return nil |
| 75 | +-} |
| 76 | +- |
| 77 | + // ContextValidate validates this search index public key based on context it is used |
| 78 | + func (m *SearchIndexPublicKey) ContextValidate(ctx context.Context, formats strfmt.Registry) error { |
| 79 | + return nil |
| 80 | +diff --git a/vendor/github.com/sigstore/rekor/pkg/util/fetch.go b/vendor/github.com/sigstore/rekor/pkg/util/fetch.go |
| 81 | +index 7f8e93f..5c5c464 100644 |
| 82 | +--- a/vendor/github.com/sigstore/rekor/pkg/util/fetch.go |
| 83 | ++++ b/vendor/github.com/sigstore/rekor/pkg/util/fetch.go |
| 84 | +@@ -21,14 +21,18 @@ import ( |
| 85 | + "fmt" |
| 86 | + "io" |
| 87 | + "net/http" |
| 88 | ++ "time" |
| 89 | + ) |
| 90 | + |
| 91 | +-// FileOrURLReadCloser Note: caller is responsible for closing ReadCloser returned from method! |
| 92 | ++// FileOrURLReadCloser reads content either from a URL or a byte slice |
| 93 | ++// Note: Caller is responsible for closing the returned ReadCloser |
| 94 | ++// Note: This must never be called from any server codepath to prevent SSRF |
| 95 | + func FileOrURLReadCloser(ctx context.Context, url string, content []byte) (io.ReadCloser, error) { |
| 96 | + var dataReader io.ReadCloser |
| 97 | + if url != "" { |
| 98 | +- //TODO: set timeout here, SSL settings? |
| 99 | +- client := &http.Client{} |
| 100 | ++ client := &http.Client{ |
| 101 | ++ Timeout: 30 * time.Second, |
| 102 | ++ } |
| 103 | + req, err := http.NewRequestWithContext(ctx, "GET", url, nil) |
| 104 | + if err != nil { |
| 105 | + return nil, err |
| 106 | +-- |
| 107 | +2.43.0 |
| 108 | + |
0 commit comments