starred/headscale
1
0
Fork 0
mirror of https://github.com/juanfont/headscale.git synced 2026-01-12 04:10:32 +01:00
Code Issues 98 Packages Projects Releases 10 Wiki Activity

[PR #823] [MERGED] Protect against user injection for registration CLI page #1668

New Issue
Closed
opened 2025-12-29 02:31:08 +01:00 by adam · 0 comments
adam commented 2025-12-29 02:31:08 +01:00
Owner
Copy Link

📋 Pull Request Information

Original PR: https://github.com/juanfont/headscale/pull/823
Author: @kradalby
Created: 9/23/2022
Status: ✅ Merged
Merged: 10/4/2022
Merged by: @juanfont

Base: main ← Head: sanitise-machine-key-url

📝 Commits (6)

  • 93082b8 Protect against user injection for registration CLI page
  • 75a8fc8 Update changelog
  • d06ba7b Merge branch 'main' into sanitise-machine-key-url
  • 2bb3475 Validate the incoming nodekey with regex before attempting to parse
  • 8be14ef gofumpt
  • 5333df2 Merge branch 'main' into sanitise-machine-key-url

📊 Changes

3 files changed (+37 additions, -3 deletions)

View changed files

📝 CHANGELOG.md (+1 -0)
📝 api.go (+30 -2)
📝 utils.go (+6 -1)

📄 Description

This commit addresses a potential issue where we allowed unsanitised content to be passed through a go template without validation.

We now try to unmarshall the incoming node key and fails to render the template if it is not a valid node key.

Signed-off-by: Kristoffer Dalby kristoffer@dalby.cc

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/juanfont/headscale/pull/823 **Author:** [@kradalby](https://github.com/kradalby) **Created:** 9/23/2022 **Status:** ✅ Merged **Merged:** 10/4/2022 **Merged by:** [@juanfont](https://github.com/juanfont) **Base:** `main` ← **Head:** `sanitise-machine-key-url` --- ### 📝 Commits (6) - [`93082b8`](https://github.com/juanfont/headscale/commit/93082b809267b8f543452a336f9d8e69c35348fb) Protect against user injection for registration CLI page - [`75a8fc8`](https://github.com/juanfont/headscale/commit/75a8fc8b3e503d1c9d5eaeb481b689351cbbc97e) Update changelog - [`d06ba7b`](https://github.com/juanfont/headscale/commit/d06ba7b5221d3291186aa5cf2abbb974808d3370) Merge branch 'main' into sanitise-machine-key-url - [`2bb3475`](https://github.com/juanfont/headscale/commit/2bb34751d19dcdfdf188db437e93a75ed9b6c14a) Validate the incoming nodekey with regex before attempting to parse - [`8be14ef`](https://github.com/juanfont/headscale/commit/8be14ef6feb160bf67f83be54624d0a83af95a16) gofumpt - [`5333df2`](https://github.com/juanfont/headscale/commit/5333df283a93f70fb7869ba3aa62974215202ded) Merge branch 'main' into sanitise-machine-key-url ### 📊 Changes **3 files changed** (+37 additions, -3 deletions) <details> <summary>View changed files</summary> 📝 `CHANGELOG.md` (+1 -0) 📝 `api.go` (+30 -2) 📝 `utils.go` (+6 -1) </details> ### 📄 Description This commit addresses a potential issue where we allowed unsanitised content to be passed through a go template without validation. We now try to unmarshall the incoming node key and fails to render the template if it is not a valid node key. Signed-off-by: Kristoffer Dalby <kristoffer@dalby.cc> --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
adam added the pull-request label 2025-12-29 02:31:08 +01:00
adam closed this issue 2025-12-29 02:31:09 +01:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
CLI
DERP
DNS
Nix
OIDC
SSH
bug
database
documentation
duplicate
enhancement
faq
good first issue
grants
help wanted
might-come
needs design doc
needs investigation
no-stale-bot
out of scope
performance
policy 📝
pull-request
Mirrored from GitHub Pull Request
 question
regression
routes
stale
tags
tailscale-feature-gap
well described ❤️
wontfix
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
adam
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/headscale#1668
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?