Potential fix for code scanning alert no. 2: Use of insecure HostKeyCallback implementation#3
Merged
Merged
Conversation
…allback implementation Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
aissat
added a commit
that referenced
this pull request
May 21, 2026
…a new FileVault for encryption; introduce filterRecords function for better record filtering Fix #1 — git wrapper deduplication: Deleted syncGitBareRun and syncGitBareOutput from sync.go; all 5 call sites now use gitBareRun/gitBareOutput from git.go. Fix #6 — BranchFor function: Added BranchFor(rec *types.FileRecord) string to git.go. Replaced 6 inline branch-construction patterns in status.go, apply.go, diff.go, and remote_deploy.go. Also corrects a latent bug: diff.go was using "track/" for remote files; BranchFor now correctly uses "remote/". Fix #5 — filterRecords function: Created filter.go with the shared ID+Tag+Path filter. Replaced ~30 lines of duplicated map-building and loop filtering in apply.go and remote_deploy.go. Fix #3 — FileVault: Created vault.go with FileVault.Encrypt/Decrypt. Replaced the three-step NewKeyManager → Load → cipher pattern in track.go, apply.go, sync.go (×2), and remote_deploy.go.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Potential fix for https://github.com/aissat/sysfig/security/code-scanning/2
In general, the fix is to replace
gossh.InsecureIgnoreHostKey()with aHostKeyCallbackthat actually verifies the server’s host key against a trusted set (an allow-list). The most straightforward secure pattern withgolang.org/x/crypto/sshis to load one or more known host public keys and usessh.FixedHostKey(for a single key) or a custom callback that checks the key against a map of allowed keys.Within
buildSSHClientConfigininternal/core/remote_deploy.go, we should introduce a small helper that loads a trusted host public key from a file path specified via an environment variable (or similar), parse it withgossh.ParsePublicKey, and then setHostKeyCallbacktogossh.FixedHostKey(publicKey). This keeps the existing authentication behaviour intact (sameauthMethods) and only changes host verification from “accept all” to “accept only this trusted key”. Because we’re constrained to the shown snippet and should avoid large behavioural changes, using a single optional allow-listed key is the least invasive: if the env var is set and the key loads successfully, we useFixedHostKey; otherwise we can fail early with an error, rather than silently falling back to insecure behaviour.Concretely:
buildSSHClientConfig, e.g.func loadHostKeyCallback() (gossh.HostKeyCallback, error).SYSFIG_SSH_HOST_KEY(name is arbitrary but descriptive; we can introduce it here), useos.ReadFileandgossh.ParsePublicKey, and returngossh.FixedHostKey(pubKey).buildSSHClientConfigto callloadHostKeyCallback; if it returns an error, propagate it; if it returns nil callback (e.g. env not set), return an error indicating that host verification is not configured.gossh.InsecureIgnoreHostKey()use on line 435 with the previously obtainedhostKeyCallback.This keeps imports unchanged (we already import
gosshandos) and maintains the current authentication options while making host key verification secure and explicit.Suggested fixes powered by Copilot Autofix. Review carefully before merging.