Skip to content

fix: record blocked fetches and enforce URL rules on store-and-forward path#198

Merged
coopernetes merged 1 commit into
mainfrom
fix/197-blocked-fetch-recording
May 3, 2026
Merged

fix: record blocked fetches and enforce URL rules on store-and-forward path#198
coopernetes merged 1 commit into
mainfrom
fix/197-blocked-fetch-recording

Conversation

@coopernetes
Copy link
Copy Markdown
Member

Summary

Fixes two distinct gaps in blocked-fetch recording identified in #197.

  • Gap 1 — store-and-forward fetch enforcement: registerGitServlet now wires ParseGitRequestFilter + UrlRuleAggregateFilter onto the /push/ path. Previously, git clone/fetch requests via the store-and-forward endpoint bypassed URL allowlist checks entirely and were never written to FetchStore. There are no JGit hooks for fetch operations (UploadPack is read-only), so the servlet filter layer is the correct place to enforce this.

  • Gap 2 — info/refs phase recording: UrlRuleAggregateFilter.applyInfoRefsRules() now calls recordFetch(request, false) for Denied and NotAllowed results when the effective operation is FETCH. Previously, blocked clones/fetches rejected at the /info/refs discovery handshake were silently dropped — since the upload-pack request never arrived, the existing recordFetch call in the upload-pack branch was never reached.

Test plan

  • UrlRuleFilterTest — four new unit tests covering: NotAllowed fetch on /info/refs records BLOCKED, deny-rule fetch on /info/refs records BLOCKED, push on /info/refs does NOT record fetch, allowed fetch on /info/refs does NOT record fetch
  • Full build passes with coverage threshold met
  • Verify e2e via test-clone.sh against a repo not in the allow list — blocked fetch should appear in the Repos page metrics

closes #197

…d path

Gap 1: `registerGitServlet` now wires `ParseGitRequestFilter` and
`UrlRuleAggregateFilter` onto the `/push/` path. Previously, fetches
via the store-and-forward endpoint bypassed URL allowlist checks
entirely and were never written to `FetchStore`.

Gap 2: `UrlRuleAggregateFilter.applyInfoRefsRules()` now calls
`recordFetch(request, false)` for `Denied` and `NotAllowed` results
when the effective operation is FETCH. Previously, blocked clones/fetches
rejected at the `/info/refs` discovery phase were never recorded —
since the upload-pack request never arrived, the existing `recordFetch`
call there was never reached.

closes #197

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@coopernetes coopernetes enabled auto-merge May 3, 2026 21:26
@coopernetes coopernetes merged commit 8bc1194 into main May 3, 2026
13 checks passed
@coopernetes coopernetes deleted the fix/197-blocked-fetch-recording branch May 3, 2026 21:28
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Blocked fetches not recorded in FetchStore (store-and-forward has no allowlist check; info/refs phase missing recordFetch call)

1 participant