Skip to content

fix(gitlab): pin pagination cursor to configured host + consolidate isSameOrigin #4873

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
waleedlatif1 merged 2 commits into from
Jun 3, 2026
Merged

fix(gitlab): pin pagination cursor to configured host + consolidate isSameOrigin #4873

Changes from 1 commit
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
0a7ebd8
fix(gitlab): pin pagination cursor to configured host before followin…
waleedlatif1 Jun 3, 2026
6c7e41a
improvement(validation): generalize isSameOrigin and reuse across con…
waleedlatif1 Jun 3, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Next Next commit
fix(gitlab): pin pagination cursor to configured host before followin… 
…g it

The repository-tree keyset cursor stores GitLab's verbatim rel="next"
URL and re-fetches it with an Authorization: Bearer header. Assert the
cursor's origin matches the configured apiBase before following it, so a
tampered or corrupted fileNextUrl cannot exfiltrate the access token to
an attacker-controlled host. Fails closed on mismatch.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
  • Loading branch information
@waleedlatif1 @claude
waleedlatif1 and claude committed Jun 3, 2026
commit 0a7ebd848f980a7ea4bcb9fcbb327e1076f12234
18 changes: 18 additions & 0 deletions apps/sim/connectors/gitlab/gitlab.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -103,6 +103,21 @@ function parseNextLink(linkHeader: string | null): string | undefined {
return undefined
}

/**
* Returns true when `candidate` resolves to the same origin as `base`. Used to
* pin a persisted pagination cursor to the configured GitLab host before
* following it with an `Authorization` header, so a tampered or corrupted
* `fileNextUrl` cannot exfiltrate the access token to an attacker-controlled
* host. Returns false on any unparseable URL.
*/
function isSameOrigin(candidate: string, base: string): boolean {
try {
return new URL(candidate).origin === new URL(base).origin
} catch {
return false
}
}

/**
* Returns the ordered list of active sync phases for a content-type choice.
*/
Expand Down Expand Up @@ -741,6 +756,9 @@ export const gitlabConnector: ConnectorConfig = {
per_page: String(PAGE_SIZE),
pagination: 'keyset',
})
if (state.fileNextUrl && !isSameOrigin(state.fileNextUrl, apiBase)) {
throw new Error('GitLab pagination cursor points to an unexpected host')
}
const url =
state.fileNextUrl ??
`${apiBase}/projects/${encodedProject}/repository/tree?${treeParams.toString()}`
Expand Down