fix(server): match webhook platform by unique host when external_url port differs (v0.9.46) - #134
Merged
Merged
Conversation
…port differs (v0.9.46) Self-hosted GitLab behind a port mapping advertises external_url with a non-default port (e.g. https://host:8443), so webhook payloads carry that port while the configured Git platform entry targets the reachable URL (https://host). Strict (host, port) matching failed and inbound verification fell through to the empty env runtime, answering every hook with 403 "no verification configured". find_git_platform_for_url now falls back to a host-only match after strict matching fails, hitting only when the host identifies exactly one entry with webhook verification credentials (token-only entries neither win nor make the fallback ambiguous). Strict matches keep absolute priority. REST gitlab_mr token resolution switches to the new find_git_platform_for_url_strict: the resolved token is sent outbound to the MR URL's host:port and must never flow to an unconfigured port.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
Self-hosted GitLab behind a port mapping (
external_url = https://host:8443) sends webhook payloads whoseproject.web_urlcarries:8443, while the reng Git 平台 entry is configured against the container-reachablehttps://host. Strict(host, port)matching infind_git_platform_for_urlfailed, so inbound webhook verification fell through to the empty env runtime and every hook got 403no verification configured— verified live against a real GitLab EE 19.2.4 instance.Fix
find_git_platform_for_url(INBOUND, webhook verification): after stricthost[:port]matching fails, fall back to a host-only match. Hits only when the URL's host identifies exactly one entry with webhook verification credentials — token-only entries neither win the fallback nor make it ambiguous; ambiguous/unknown hosts still yieldNone. Strict matches keep absolute priority.find_git_platform_for_url_strictfor the OUTBOUND path: RESTgitlab_mrtoken resolution (resolve.rs) stays strict, because a resolved token is sent to the MR URL's host:port and must never flow to an unconfigured port.Verification
cargo fmt --check/cargo clippy --all-targets --all-features: cleancargo test git_platform: 28 passed (7 new tests: strict priority, both fold directions, ambiguity, unknown host, strict never folds, token-only filter × 2):8443→ 403 before; matches after fix