fix: allow-list git_url before install_extension spawns git clone

[matiaspalmac]

[Fix]: Allow-list git_url before install_extension spawns git clone

Description

install_extension forwarded the caller-supplied git_url straight
to git clone. Any scheme went through — file://, Windows UNC,
ssh://, git://, and the especially dangerous ext:: transport
helpers. A compromised catalog entry could therefore trigger arbitrary
code at install time via git helpers, symlink tricks, or
credential-embedding URLs. Combined with the plain-HTTP registry fixed
in #162 and the fragile .replace derivation fixed in #157, this was
the final gate between a MITM and code execution on the user's
machine.

Change

apps/desktop/src-tauri/src/extensions.rs — new
validate_git_clone_url is called before install_extension
builds a target directory, and the clone invocation now runs with
defensive git -c flags.

URL validation

• Strict https:// scheme (case-sensitive). Catches HTTP://,
  http://, file://, ssh://, git://, UNC \\host\share, etc.
• Host allowlist: github.com, gitlab.com, bitbucket.org.
  Every legitimate catalog entry today already satisfies this, and
  the frontend helper resolveGitRepoUrl produces exactly this
  shape.
• Path: exactly <owner>/<repo> or <owner>/<repo>.git.
• Segment content: ASCII alphanumeric + -, _, .; no leading
  - (prevents --upload-pack / --config= flag injection through
  the path).
• No credentials or alternate-host tricks: rejects any @ in the
  authority section (https://user@github.com/...,
  https://github.com@evil.example/...).
• No transport-helper syntax: rejects any :: anywhere in the
  URL.
• No control characters or whitespace.

Clone hardening

Clone is now invoked as:

git -c protocol.ext.allow=never \
    -c protocol.file.allow=never \
    -c protocol.git.allow=never \
    clone --depth 1 <url> <target>

The allow-listed https host is unaffected. If anything ever gets
past the URL check, git itself refuses those transports at runtime.

Tests

Added git_url_validation_tests with 12 cases covering the
accept/reject matrix. cargo test git_url_validation → 12/12 pass.

Trade-offs

• Allowlist is conservative. Only three hosts are accepted today.
  Catalog entries on other git hosts (codeberg, sourcehut, self-hosted
  instances) would be rejected. That matches the marketplace's
  current scope; widening it later is a one-line diff.
• No .git suffix required. I considered requiring .git on the
  repo segment, but GitHub/GitLab both redirect …/owner/repo to the
  .git form for git clients, and resolveGitRepoUrl on the
  frontend already appends .git when it normalizes URLs. Both
  shapes are accepted.
• update_extension / uninstall_extension not touched. Those
  operate on the already-cloned directory and don't take a URL
  argument, so they're not part of the git clone attack surface
  the issue describes. Hardening them (e.g. adding the same -c
  flags to git pull) is a separate improvement.

Verification

• cargo check, cargo clippy --tests -- -D warnings → clean.
• cargo test git_url_validation → 12 passed.
• Manual trace against the in-tree marketplace entry (the example
  addon on github.com/TrixtyAI) → clone still succeeds.
• Each rejection branch exercised by a unit test, listed in
  git_url_validation_tests.

Related Issue

Fixes #55

Checklist

• I have tested this on the latest version.
• I have followed the project's coding guidelines.
• My changes generate no new warnings or errors.
• I have verified the fix on:
  • OS: Windows
  • Version: v1.0.10

[github-actions]

Thanks for the contribution! I'll review it as soon as possible. If you have still changes, please mark this PR as draft and all reviews will be cancelled. Tests reviews will be re-run only when the PR is marked as ready for review.

[Copilot]

Pull request overview

Hardens extension installation by validating marketplace-provided git_url before invoking git clone, and adding defensive Git protocol configuration to reduce transport-helper abuse risk.

Changes:

• Add validate_git_clone_url with a strict https:// + host allowlist + path/character constraints.
• Invoke git clone with -c protocol.*.allow=never flags to disable risky transports at runtime.
• Add unit tests covering accepted/rejected URL cases.

Comments suppressed due to low confidence (1)

apps/desktop/src-tauri/src/extensions.rs:344

• target_dir.to_str().unwrap() can panic if the path contains non-UTF8 data. Prefer passing the path as an OsStr/Path argument (e.g., build the Command with .arg(&git_url) and .arg(&target_dir)), or return a proper error if UTF-8 conversion fails instead of unwrapping.

            "1",
            &git_url,
            target_dir.to_str().unwrap(),
        ])

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.