From 545a0d65051d6f59753db744a17cbb55d26e9567 Mon Sep 17 00:00:00 2001 From: Freek van Rijt Date: Wed, 28 Oct 2026 12:08:10 +0100 Subject: [PATCH] Allowlist shopware.github.io and mirror.mage-os.org for composer jobs Co-Authored-By: Claude Opus 5.5 --- internal/handlers/egress_allowlist_defaults.yaml | 6 +++++- internal/handlers/egress_allowlist_test.go | 5 +++++ 2 files changed, 10 insertions(+), 1 deletion(-) diff --git a/internal/handlers/egress_allowlist_defaults.yaml b/internal/handlers/egress_allowlist_defaults.yaml index bcac4b2..c94a055 100644 --- a/internal/handlers/egress_allowlist_defaults.yaml +++ b/internal/handlers/egress_allowlist_defaults.yaml @@ -387,9 +387,13 @@ ecosystem_default_domains: - asset-packagist.org - cdn.asset-packagist.org - satis.spatie.be - # Composer repository published via GitHub Pages. Exact only: + # Mage-OS public mirror of the Magento Open Source packages. + - mirror.mage-os.org + # Composer repositories published via GitHub Pages. Exact only: # github.io subdomains are user-creatable. - wp-languages.github.io + # Shopware's shopware/conflicts metapackage, required by shopware/core. + - shopware.github.io go_modules: - proxy.golang.org - sum.golang.org diff --git a/internal/handlers/egress_allowlist_test.go b/internal/handlers/egress_allowlist_test.go index 6c57659..4a0f7d5 100644 --- a/internal/handlers/egress_allowlist_test.go +++ b/internal/handlers/egress_allowlist_test.go @@ -682,6 +682,8 @@ func TestEgressAllowlist_ProdBlockedHostsNowAllowed(t *testing.T) { "https://dl.fontawesome.com/releases/v6/fontawesome.zip", "https://mirrors.cloud.tencent.com/gradle/gradle-8.0-bin.zip", "https://satis.spatie.be/packages.json", + "https://mirror.mage-os.org/p2/magento/framework.json", + "https://shopware.github.io/conflicts/packages.json", "https://download.swift.org/swift-5.9-release/toolchain.tar.gz", "https://releases.bazel.build/7.0.0/release/bazel-7.0.0-linux-x86_64", }, @@ -762,6 +764,8 @@ func TestEgressAllowlist_NewEntriesDoNotWidenBeyondExactHosts(t *testing.T) { "https://evil.wiz-sec.github.io/payload", "https://evil.fluent.github.io/payload", "https://evil.adsbynimbus-public.s3.amazonaws.com/payload", + "https://evil.mirror.mage-os.org/payload", + "https://evil.shopware.github.io/payload", } // Sibling hosts: names sharing a parent with an added entry. These pin the @@ -784,6 +788,7 @@ func TestEgressAllowlist_NewEntriesDoNotWidenBeyondExactHosts(t *testing.T) { "https://attacker.releases.hashicorp.com/payload", "https://attacker.releases.teleport.dev/payload", "https://attacker.wiz.io/payload", + "https://attacker.mage-os.org/payload", // Cloudsmith is multi-tenant with the tenant in the URL path, and the // allowlist authorizes the hostname only. Neither the tenant subdomain // form nor the shared download hosts may be globally allowed.