Apply Git branch dropdown select #1416

vinokurig · 2025-11-27T10:12:10Z

What does this PR do?

Fetch list of the repository's branches by executing git ls-remote <repo url>
Reveal the Git branches list to the dropdown in the Git Branch section:

Screenshot/screencast of this PR

What issues does this PR fix or reference?

fixes eclipse-che/che#23171

Is it tested? How?

Deploy che with the pull request image: quay.io/eclipse/che-dashboard:pr-
Paste a Git repository URL to the Import from Git section.
Go to Git Repo Options and click the Git Branch dropdown, see: Git branches list is revealed.
Choose a Git branch from the list, see: the git branch is applied to the repository URL.
Edit the repository URL to be invalid e.g. https://github.com/vinokurig/t, see: empty branch list warning is shown:

Release Notes

Docs PR

openshift-ci · 2025-11-27T10:12:18Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: vinokurig

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

che-bot · 2025-11-27T10:12:18Z

Click here to review and test in web IDE:

packages/dashboard-backend/src/services/gitClient/index.ts

build/dockerfiles/Dockerfile

packages/dashboard-backend/src/services/gitClient/index.ts

akurinnoy · 2025-11-27T12:53:25Z

packages/dashboard-backend/src/services/gitClient/index.ts

+export async function getBranches(url: string): Promise<api.IGitBranches | undefined> {
+  try {
+    return new Promise((resolve, reject) => {
+      run(`git`, ['ls-remote', '--refs', url], 1000)


@vinokurig please sanitize the url to prevent injections.

I don't think we need to do anything with URLs here; moreover, modifying the URL here can add some edge cases.

I think the best approach to protect backend just to validate the target URL with provider patterns:

/packages/dashboard-frontend/src/store/Workspaces/Preferences/helpers.ts

export const gitProviderPatterns = { github: { https: /^https:\/\/github\.com\/([^\\/]+\/[^\\/]+)(?:\/.*)?$/, ssh: /^(?:(?:git\+)?ssh:\/\/)?git@github\.com:([^\\/]+\/[^\\/]+?)(?:\.git)?$/, }, gitlab: { https: /^https:\/\/gitlab\.com\/([^\\/]+\/[^\\/]+)(?:\/.*)?$/, ssh: /^(?:(?:git\+)?ssh:\/\/)?git@gitlab\.com:([^\\/]+\/[^\\/]+?)(?:\.git)?$/, }, bitbucket: { https: /^https:\/\/bitbucket\.org\/([^\\/]+\/[^\\/]+)(?:\/.*)?$/, ssh: /^(?:(?:git\+)?ssh:\/\/)?git@bitbucket\.org:([^\\/]+\/[^\\/]+?)(?:\.git)?$/, }, azureDevOps: { https: /^https:\/\/(?:\w+@)?dev\.azure\.com\/([^\\/]+\/[^\\/]+\/_git\/[^\\/]+?)(?:\?.*)?$/, ssh: /^(?:ssh:\/\/)?git@ssh\.dev\.azure\.com:v3\/([^\\/]+\/[^\\/]+\/[^\\/]+)(?:\/[^\\/]+)?$/, }, };

If it is valid - execute code. If not - return the proper error.

@akurinnoy WDYT?

I think we could also add a time-limited cashing option here. Since multiple users may be requesting the same repository(It is optional)

With this we will limit the functionality to just 4 supported git providers, server version of supported git providers will not be included. On the other hand, this will protect the dashboard container from executing git ls-remote with suspicious urls.
My proposal is to add a simple http https ssh validation and probably a character quantity limit.
@akurinnoy @svor We need to make a decision here: limited functionality or security protection.

we have to support GitLab and Bitbucket servers as well. This providers may have custom host URLs, I'm not sure if the pattern provided above will work

@olexii4 @vinokurig @svor I would also prefer more general URL validation to exclude possible injections.

@olexii4 Regarding the server-side caching, I would rather disagree, because this will introduce security issues. But, the client-side cashing sounds reasonable to me.

packages/dashboard-frontend/src/components/ImportFromGit/RepoOptionsAccordion/index.tsx

github-actions · 2025-11-28T15:14:10Z

Docker image build succeeded: quay.io/eclipse/che-dashboard:pr-1416

kubectl patch command

kubectl patch -n eclipse-che "checluster/eclipse-che" --type=json -p="[{"op": "replace", "path": "/spec/components/dashboard/deployment", "value": {containers: [{image: "quay.io/eclipse/che-dashboard:pr-1416", name: che-dashboard}]}}]"

codecov · 2025-11-28T16:37:37Z

Codecov Report

❌ Patch coverage is 84.75452% with 59 lines in your changes missing coverage. Please review.
✅ Project coverage is 92.14%. Comparing base (239203a) to head (2f4b92c).
⚠️ Report is 2 commits behind head on main.

Files with missing lines	Patch %	Lines
...d-frontend/src/components/ImportFromGit/helpers.ts	50.00%	18 Missing ⚠️
...tend/src/services/backend-client/gitBranchesApi.ts	79.31%	16 Missing and 2 partials ⚠️
...nd/src/devworkspaceClient/services/helpers/exec.ts	10.52%	17 Missing ⚠️
.../dashboard-backend/src/services/gitClient/index.ts	91.17%	3 Missing ⚠️
...cordion/GitRepoOptions/GitBranchDropdown/index.tsx	97.43%	3 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #1416      +/-   ##
==========================================
- Coverage   92.18%   92.14%   -0.04%     
==========================================
  Files         511      514       +3     
  Lines       47614    47926     +312     
  Branches     3432     3472      +40     
==========================================
+ Hits        43891    44161     +270     
- Misses       3682     3726      +44     
+ Partials       41       39       -2

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

packages/dashboard-backend/src/services/gitClient/index.ts

+export async function getBranches(url: string): Promise<api.IGitBranches | undefined> {
+  try {
+    return new Promise((resolve, reject) => {
+      run(`git`, ['ls-remote', '--refs', url], 1000)


The safest and most effective fix is to validate the url argument in the getBranches function before invoking the run command. This ensures that it cannot begin with a dash (i.e., -) or contain a string that would cause it to be interpreted as a git option rather than a repository address. The validation should accept only valid Git remote URLs (e.g., those beginning with git@, http://, https://, ssh://, or that conform to accepted address formats), and reject any value that could be used for command injection.
The change should be made directly inside the getBranches function, as that is the main sink for the tainted value.
The fix requires either a simple check (rejecting any value that starts with a dash), or a more rigorous check (accepting only URLs that match expected patterns).

github-actions · 2025-12-03T06:34:17Z

Docker image build succeeded: quay.io/eclipse/che-dashboard:pr-1416

kubectl patch command

kubectl patch -n eclipse-che "checluster/eclipse-che" --type=json -p="[{"op": "replace", "path": "/spec/components/dashboard/deployment", "value": {containers: [{image: "quay.io/eclipse/che-dashboard:pr-1416", name: che-dashboard}]}}]"

svor · 2025-12-04T11:15:38Z

build/dockerfiles/Dockerfile

 FROM docker.io/node:18.19.1-alpine3.19

-RUN apk --no-cache add curl
+RUN apk --no-cache add curl git


Don’t forget to include Git in the downstream image

done, see https://gitlab.cee.redhat.com/codeready-workspaces/devspaces-images/-/merge_requests/1442

akurinnoy · 2025-12-04T11:27:45Z

packages/dashboard-backend/src/devworkspaceClient/services/helpers/exec.ts

+export function run(cmd: string, args?: string[], timeOut?: number): Promise<string> {
+  let command: ChildProcessWithoutNullStreams;
+  const promise: Promise<string> = new Promise((resolve, reject) => {
+    command = spawn(cmd, args);
    let result = '';
    command.stdout.on('data', data => {
      result += data.toString();
    });
    command.on('close', () => {
      resolve(result.replace(/\n/g, ' ').trim());
    });
    command.on('error', err => {
      reject(err);
    });
  });
+  if (timeOut && timeOut > 0) {
+    const timeoutPromise: Promise<string> = new Promise((_, reject) => {
+      setTimeout(() => {
+        if (command && command.exitCode == null) {
+          command.kill();
+          reject(new Error('Timeout exceeded'));
+        }
+      }, timeOut);
+    });
+    return Promise.race([promise, timeoutPromise]);
+  } else {
+    return promise;
+  }


Please, use async/await for better readability and maintainability.

We need to define the promises explicitly for the Promise.race function.

akurinnoy · 2025-12-04T11:28:56Z

packages/dashboard-backend/src/services/gitClient/index.ts

+      run(`git`, ['ls-remote', '--refs', url], 1000)
+        .then(result => {
+          resolve({
+            branches: result
+              .split(' ')
+              .filter(b => b.indexOf('refs/heads/') > 0 || b.indexOf('refs/tags/') > 0)
+              .map(b => b.replace(new RegExp('.*\\trefs/((heads)|(tags))/'), '')),
+          });
+        })
+        .catch(err => reject(err));
+    });
+  } catch (error) {
+    return undefined;
+  }
+}


Please, use async/await for better readability and maintainability.

akurinnoy · 2025-12-04T11:30:25Z

packages/dashboard-frontend/src/components/ImportFromGit/RepoOptionsAccordion/index.tsx

+    fetchGitBranches(getRepositoryUrlFromLocation(location))
+      .then(branches => {
+        state.branchList = branches.branches;
+        this.setState(state);
+      })
+      .catch(() => {
+        state.branchList = undefined;
+        this.setState(state);
+      });


Please, use async/await for better readability and maintainability.

vinokurig requested review from akurinnoy, ibuziuk and olexii4 as code owners November 27, 2025 10:12

github-advanced-security bot found potential problems Nov 27, 2025

View reviewed changes

packages/dashboard-backend/src/services/gitClient/index.ts Fixed Show fixed Hide fixed

vinokurig force-pushed the che-23171 branch from ce75a30 to 53be00c Compare November 27, 2025 10:23

olexii4 reviewed Nov 27, 2025

View reviewed changes

build/dockerfiles/Dockerfile Show resolved Hide resolved

packages/dashboard-backend/src/services/gitClient/index.ts Show resolved Hide resolved

akurinnoy reviewed Nov 27, 2025

View reviewed changes

packages/dashboard-frontend/src/components/ImportFromGit/RepoOptionsAccordion/index.tsx Show resolved Hide resolved

vinokurig force-pushed the che-23171 branch 2 times, most recently from 04f74f5 to f8826a9 Compare November 28, 2025 15:03

Apply Git branch dropdown select

0b56f66

vinokurig force-pushed the che-23171 branch from f8826a9 to 0b56f66 Compare November 28, 2025 15:05

github-advanced-security bot found potential problems Dec 3, 2025

View reviewed changes

fixup! Apply Git branch dropdown select

2f4b92c

vinokurig force-pushed the che-23171 branch from 28c0fbf to 2f4b92c Compare December 3, 2025 06:25

svor self-requested a review December 3, 2025 11:53

svor reviewed Dec 4, 2025

View reviewed changes

akurinnoy reviewed Dec 4, 2025

View reviewed changes

@@ -15,6 +15,15 @@
             import { run } from '@/devworkspaceClient/services/helpers/exec';
             export async function getBranches(url: string): Promise<api.IGitBranches | undefined> {
+              // Disallow remote URLs that start with "-" (prevent git option injection)
+              // Optionally, only allow typical git URLs: git@, http(s)://, ssh://
+              if (
+                typeof url !== 'string' ||
+                url.startsWith('-') ||
+                !(url.startsWith('git@') || url.startsWith('https://') || url.startsWith('http://') || url.startsWith('ssh://'))
+              ) {
+                throw new Error('Invalid remote URL: ' + url);
+              }
               try {
                 return new Promise((resolve, reject) => {
                   run(`git`, ['ls-remote', '--refs', url], 1000)

Apply Git branch dropdown select #1416

Are you sure you want to change the base?

Apply Git branch dropdown select #1416

Uh oh!

Conversation

vinokurig commented Nov 27, 2025

What does this PR do?

Screenshot/screencast of this PR

What issues does this PR fix or reference?

Is it tested? How?

Release Notes

Docs PR

Uh oh!

openshift-ci bot commented Nov 27, 2025

Uh oh!

che-bot commented Nov 27, 2025

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

vinokurig Dec 3, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

github-actions bot commented Nov 28, 2025

Uh oh!

codecov bot commented Nov 28, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

Check failure

Uh oh!

Copilot Autofix

github-actions bot commented Dec 3, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

vinokurig Dec 3, 2025 •

edited

Loading

codecov bot commented Nov 28, 2025 •

edited

Loading