74 commits

Author	SHA1	Message	Date
Andrew Nesbitt	38213d9631	Merge pull request #23 from git-pkgs/fix-browse-xss ... Fix XSS in browse source file tree	2026-03-13 07:25:57 +00:00
Andrew Nesbitt	3ec353c624	Merge pull request #24 from git-pkgs/fix-error-disclosure ... Stop leaking internal error details to clients	2026-03-13 07:25:44 +00:00
Andrew Nesbitt	bf7e83efe3	Reject path traversal in debian and rpm handlers ... The debian and rpm handlers take the request path and pass it directly to the upstream URL without checking for ".." segments. This could let a client craft a request that reaches unintended upstream paths. Add a containsPathTraversal check at the entry point of both handlers and return 400 for any path containing ".." segments.	2026-03-12 12:05:52 +00:00
Andrew Nesbitt	3d6ebc9522	Stop leaking internal error messages in API and health responses ... Replace err.Error() in HTTP error responses with generic messages. Internal details like database driver errors and enrichment failures were being sent directly to clients.	2026-03-12 12:01:29 +00:00
Andrew Nesbitt	9e97a3316a	Escape user-controlled strings in browse source JavaScript ... File paths from archive contents were interpolated directly into onclick handlers and innerHTML via template literals. A crafted filename containing quotes could break out of the string context and execute arbitrary JS. Add an escapeHTML helper and use it on all interpolated path and URL values in the browse source page.	2026-03-12 11:59:14 +00:00
Andrew Nesbitt	82443e137f	Add generated OpenAPI docs support	2026-03-12 11:49:31 +00:00
Andrew Nesbitt	fe32236a57	Remove hard-coded ecosystems from templates	2026-03-11 17:25:47 +00:00
Andrew Nesbitt	4f8f63f354	Add version cooldown to filter recently published packages ... Hides package versions published too recently from metadata responses, giving the community time to spot malicious releases. Configurable per-ecosystem and per-package with duration overrides. Supported for npm, PyPI, pub.dev, and Composer.	2026-03-04 19:00:31 +00:00
Andrew Nesbitt	364549ad14	Replace inline PURL construction with purl library ... Uses purl.MakePURLString() instead of fmt.Sprintf("pkg:...") for correct namespace handling (npm scopes, Go module paths, Maven group IDs) and percent-encoding. Replaces hand-rolled extractEcosystem and inline PURL parsing in the bulk lookup fallback with purl.Parse().	2026-03-04 09:20:16 +00:00
Andrew Nesbitt	07778d9727	Replace internal/diff with archives/diff ... The diff package has been extracted into the archives module where it belongs, since it operates on archives.Reader. This removes the internal copy and imports from github.com/git-pkgs/archives/diff instead.	2026-02-27 10:55:10 +00:00
Andrew Nesbitt	be8c4b9860	Replace internal/upstream with registries/fetch ... Use the new client/ and fetch/ sub-packages from git-pkgs/registries instead of the local upstream package. The fetcher, circuit breaker, and resolver now live in registries where they can be shared across projects. Depends on git-pkgs/registries#8.	2026-02-20 17:31:12 +00:00
Andrew Nesbitt	e6645f38c9	Fix staticcheck QF1012 lint warnings in diff package	2026-02-20 07:53:24 +00:00
Andrew Nesbitt	4d5098e044	Remove internal/archive package, replaced by git-pkgs/archives dependency	2026-02-16 11:11:48 +00:00
Andrew Nesbitt	8ddf07587c	Fix golangci-lint errors (errcheck, staticcheck, unused)	2026-02-16 10:53:21 +00:00
Andrew Nesbitt	e35394bee3	Use shared github.com/git-pkgs/enrichment module	2026-02-06 10:37:00 +00:00
Andrew Nesbitt	2d7cb8eae5	Refactoring and features	2026-02-03 22:40:40 +00:00
Andrew Nesbitt	9c974a0a81	Fix Windows CI test failures ... - Use proper file:/// URL format for Windows paths in blob storage tests - Accept both text/javascript and application/javascript MIME types	2026-01-29 21:12:13 +00:00
Andrew Nesbitt	658e9621d8	Add Container, Debian, RPM handlers and enrichment API ... Adds proxy support for Docker/OCI container registries, Debian/APT repositories, and RPM/Yum repositories. Includes a new enrichment API for package metadata, vulnerability scanning, and outdated detection. Updates the dashboard with Tailwind CSS, dark mode support, and a security overview section showing vulnerability counts.	2026-01-29 19:35:15 +00:00
Andrew Nesbitt	1eb9d71bd7	Align database schema with git-pkgs for compatibility ... The proxy can now use an existing git-pkgs database as a starting point. Packages and versions tables match git-pkgs schema, using PURL-based references instead of integer IDs. The proxy adds its own artifacts table for caching functionality.	2026-01-29 16:44:01 +00:00
Andrew Nesbitt	fcc5289f97	Add auth pass-through for upstream registries ... Configure authentication per URL prefix in config: upstream: auth: "https://registry.npmjs.org": type: bearer token: "${NPM_TOKEN}" Supports bearer tokens, basic auth, and custom headers. Credentials can reference environment variables with ${VAR_NAME} syntax. The longest matching URL prefix wins when multiple patterns match.	2026-01-29 16:33:09 +00:00
Andrew Nesbitt	ba754f8a79	Add gocloud.dev/blob for S3 and filesystem storage ... Replace custom filesystem storage with gocloud.dev/blob for unified storage backend support. Supported backends: - file:///path/to/dir - Local filesystem (default) - s3://bucket-name - Amazon S3 - s3://bucket?endpoint=http://localhost:9000 - S3-compatible (MinIO) Configuration via: - CLI flag: -storage-url - Environment: PROXY_STORAGE_URL - Config file: storage.url The old storage.path config is deprecated but still supported.	2026-01-29 16:13:16 +00:00
Andrew Nesbitt	41aa11ab66	Add sqlx with SQLite default and PostgreSQL option ... Replace raw database/sql with jmoiron/sqlx for cleaner query handling. Support both SQLite (default) and PostgreSQL as configurable backends. Configuration via: - CLI flags: -database-driver, -database-path, -database-url - Environment: PROXY_DATABASE_DRIVER, PROXY_DATABASE_PATH, PROXY_DATABASE_URL - Config file: database.driver, database.path, database.url Tests run against both databases when PROXY_DATABASE_URL is set.	2026-01-29 16:06:56 +00:00
Andrew Nesbitt	7b1bdf75f7	Extract checkCache helper to reduce duplication	2026-01-21 22:47:23 +00:00
Andrew Nesbitt	7b22638ef7	Hello world	2026-01-20 22:00:31 +00:00