Skip to content

Allow the Nexus S3 blob store that packages.nuxeo.com redirects to #291

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
ataillefer wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Allow the Nexus S3 blob store that packages.nuxeo.com redirects to #291

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 6 additions & 0 deletions internal/handlers/egress_allowlist_defaults.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -317,6 +317,12 @@ ecosystem_default_domains:
# Exact virtual-hosted S3 bucket (Automattic's public Android libraries).
# Never the path-style "s3.amazonaws.com" apex, which reaches every bucket.
- a8c-libs.s3.amazonaws.com
# Nexus S3 blob store that packages.nuxeo.com above 302-redirects every
# download to. Exact virtual-hosted bucket, never a glob: "nuxeo-devtools-"
# is not a reserved AWS namespace, so any sibling name is registrable by
# anyone and a "nuxeo-devtools-*.s3.*.amazonaws.com" pattern would match an
# attacker-controlled bucket.
- nuxeo-devtools-nexus-central.s3.eu-west-1.amazonaws.com
# Changelog/release-note host for Log4j and friends, not a registry.
- logging.apache.org
gradle: *jvm_registries
Expand Down
8 changes: 7 additions & 1 deletion internal/handlers/egress_allowlist_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1267,6 +1267,7 @@ func TestEgressAllowlist_PublicRegistriesThirdWaveAllowed(t *testing.T) {
"https://jcenter.bintray.com/com/google/guava/guava/maven-metadata.xml",
"https://salesforce-marketingcloud.github.io/MarketingCloudSDK-Android/maven-metadata.xml",
"https://a8c-libs.s3.amazonaws.com/android/com/automattic/maven-metadata.xml",
"https://nuxeo-devtools-nexus-central.s3.eu-west-1.amazonaws.com/storage/content/2026/10/01/22/02/82a2a8b2-184e-44a0-bc23-13e331e9fe10.bytes",
"https://pkg.kzu.app/index.json",
"https://archivist.terraform.io/v1/object/abc123",
"https://storage.julialang.net/registries/23338594-aafe-5451-b93e-139f81909106",
Expand All @@ -1285,6 +1286,10 @@ func TestEgressAllowlist_PublicRegistriesThirdWaveAllowed(t *testing.T) {
// the region must never be globbed.
"https://julialang-storage-eu-west-1.s3.eu-west-1.amazonaws.com/payload",
"https://julialang-storage-evil.s3.us-east-1.amazonaws.com/payload",
// Sibling Nuxeo bucket names are unregistered and therefore claimable,
// so neither the bucket nor the region may be globbed.
"https://nuxeo-devtools-nexus-evil.s3.eu-west-1.amazonaws.com/payload",
"https://nuxeo-devtools-nexus-central.s3.us-east-1.amazonaws.com/payload",
// github.io subdomains are user-creatable; one Pages repo must not
// expose the namespace or any sibling.
"https://evil.salesforce-marketingcloud.github.io/payload",
Expand Down Expand Up @@ -1318,11 +1323,12 @@ func TestEgressAllowlist_PublicRegistriesThirdWaveAllowed(t *testing.T) {
"https://evil.pkg.kzu.app/payload",
"https://evil.archivist.terraform.io/payload",
"https://evil.storage.julialang.net/payload",
// The two exact S3 entries need child probes of their own: the sibling
// The exact S3 entries need child probes of their own: the sibling
// and apex probes above catch a glob or a path-style widening, but only
// these catch the entry being changed to a leading-dot suffix.
"https://evil.a8c-libs.s3.amazonaws.com/payload",
"https://evil.julialang-storage-us-east-1.s3.us-east-1.amazonaws.com/payload",
"https://evil.nuxeo-devtools-nexus-central.s3.eu-west-1.amazonaws.com/payload",
// Lookalike parents and suffix-appending attacker domains.
"https://bintray.com/payload",
"https://talend.com/payload",
Expand Down
Loading