5 Commits

Author	SHA1	Message	Date
can1357	1344be8ae7	fix(python/robomp): restricted URLs starting with a hyphen in proxy server ... - Added a check to reject remote URLs that begin with a hyphen to prevent command-line option injection. - Updated the test suite to verify that option-shaped URLs are correctly blocked.	2026-06-23 20:26:44 +02:00
can1357	c752aee69d	security(python-robomp): implemented git remote validation and credential hardening ... - Sanitized git subprocess environment variables to prevent leakage of parent authentication tokens. - Enforced strict HTTPS protocol restrictions and source validation for all git repositories. - Implemented secure remote URL handling to neutralize malicious push URLs and prevent credential exfiltration. - Applied scoped token injection during git operations to restrict token exposure to intended targets.	2026-06-23 20:19:14 +02:00
runbgp	bc41b2ed3e	fix(robomp): refused token-bearing git ops to attacker-controlled origins ... - Extracted `_pat_safe_remote` and rejected HTTP(S) origins with embedded credentials or mismatched host/repo. - Guarded `clone` via `_assert_clone_url_safe` on the caller-supplied `clone_url` (pool has no `origin` yet). - Asserted origin safety before `fetch`, `fetch_ref`, and `fetch_pr_head` inject the PAT header. - Appended POSIX `--` separator in `omp_local` so prompts starting with `-` aren't parsed as flags. - Added proxy tests covering attacker-origin fetch rejection and unsafe `clone_url` refusal. Co-authored-by: can1357 <me@can.ac>	2026-06-23 19:57:15 +02:00
oldschoola	b945f54962	fix(robomp): clear needs-info on resume	2026-06-15 18:22:34 -07:00
can1357	2c773a12a4	Add 'python/robomp/' from commit '553fd1cfcf59e4c501c54fc81bc083ffd2ca007b' ... git-subtree-dir: python/robomp git-subtree-mainline: 4f6e70f779 git-subtree-split: 553fd1cfcf	2026-05-16 21:00:42 +02:00