bleedingdeacons / integrity-sharp

91%

push

github

fix: validate the base URL, fail fast on an opaque 403, and tidy the retry path (#18)

* ci: declare read-only permissions on the CI workflow

Every other workflow in this repository and its siblings declares
`permissions: contents: read` at the top and narrows to write only on
the jobs that push. This one declared nothing and inherited the
repository or organisation default for GITHUB_TOKEN, which on older
repositories is read/write across scopes.

No path to abuse it today: release.yml records that the organisation
disables write permissions for workflow tokens, and both publishing
steps authenticate with PACKAGES_TOKEN instead. That is an organisation
setting read from a code comment rather than verified, and if it were
ever relaxed this is the workflow that would inherit the looser default.

* fix: validate the base URL, fail fast on an opaque 403, drop the jitter lock

Three findings from the September review, all in UnityRestSharp.

**The base URL was never checked (F13).** Uri.TryCreate was called only
to derive the Host header and its result gated nothing, so a file://,
ftp:// or plain http:// base was accepted and used to build every
request URL. That is what let the bundled example ship an API key over
cleartext without anything in this library objecting. The constructor
now throws unless the result is absolute and HTTPS. Local development
against a site with no certificate opts in with allowInsecureBaseUrl,
which logs a warning and still refuses any scheme but http; the example
CLI exposes it as INTEGRITY_ALLOW_PLAINTEXT=1.

**A 403 with no Content-Type was retried (F9).** IsLikelyWafHtml
returned true for a missing Content-Type, deliberately, as "treat as
suspicious" - so a genuine permission failure served without one was
classified as a WAF page, retried five times with backoff, and had its
body written to the log on every attempt. It now fails fast. Logged
error bodies are also truncated to 1KB; header redaction already keeps
credential... (continued)

41 of 42 new or added lines in 1 file covered. (97.62%)

743 of 813 relevant lines covered (91.39%)

19.79 hits per line