GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — Refuse cross-site mirror jobs and framing of the UI by simonchrz · Pull Request #574 · git-pkgs/proxy

Conversation

@simonchrz

@simonchrz simonchrz commented Oct 24, 2026

Copy link
Copy Markdown
Contributor

Two small hardening changes for setups where the API and UI sit behind an ingress that authenticates browsers.

  • POST /api/mirror now requires Content-Type: application/json and answers 415 otherwise. A page on another site could make a visitor's browser post a text/plain form whose body parses as JSON and start mirror jobs; a JSON content type needs a CORS preflight, which the proxy never answers.
  • Every /ui response sends X-Frame-Options: DENY and Content-Security-Policy: frame-ancestors 'none', so another site cannot frame a version page and get the Delete button clicked. Browsed archive files keep their sandbox policy alongside frame-ancestors.

The curl examples in the docs already send the JSON content type.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
simonchrz added 2 commits October 24, 2026 07:48
@simonchrz
Require a JSON content type to start mirror jobs
003c760 
A page on another site could make a visitor's browser POST a text/plain
body that parses as JSON and start mirror jobs. Browsers only send
application/json cross-origin after a CORS preflight, which the proxy
never answers, so HandleCreate now refuses other content types with 415.
@simonchrz
Refuse framing of the web UI
9a78895 
Without X-Frame-Options or a frame-ancestors policy another site could
frame a version page and trick a signed-in user into clicking Delete.
Every /ui response now sends both; browsed archive files keep their
sandbox policy alongside frame-ancestors.
@andrew
andrew merged commit 08e9e7d into git-pkgs:main Oct 24, 2026
6 checks passed

Uh oh!

There was an error while loading. Please reload this page.
@simonchrz simonchrz added the breaking Changes behaviour users rely on; needs a minor release label Oct 26, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Uh oh!

There was an error while loading. Please reload this page.

Assignees

No one assigned

Labels

breaking Changes behaviour users rely on; needs a minor release

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Uh oh!

There was an error while loading. Please reload this page.

2 participants

@simonchrz @andrew
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.