mirror of
https://github.com/brunopostle/ifcurl.git
synced 2026-07-12 02:08:13 +00:00
Bruno Postle
d076196bac
The preview endpoint is co-hosted with a specific Forgejo instance, so it should only be allowed to fetch from that host. - Local file transport (ifc:///path) is always rejected with 403 — the service must not read from the server's own filesystem - New --allowed-hosts CLI option for `ifcurl serve` takes a comma-separated list of permitted git hostnames (e.g. git.example.com or localhost:3000); any unlisted host is rejected with 403 - Defense-in-depth: literal private/loopback/link-local IP addresses are blocked even without an allowlist (169.254.x.x, 127.x, RFC1918, etc.) - README and forgejo/README.md updated to include --allowed-hosts in the standard deployment invocation Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| __init__.py | ||
| __main__.py | ||
| auth.py | ||
| git.py | ||
| py.typed | ||
| render.py | ||
| service.py | ||
| url.py | ||