fix(#19314): allow ssh/altssh subdomains in repo URLs to match webhook payload

applicationset/webhook/testdata/gitlab-event.json

@@ -16,26 +16,26 @@
       "id": 1,
       "name": "project",
       "description": "",
-      "web_url": "https://gitlab/group/name",
+      "web_url": "https://gitlab.com/group/name",
       "avatar_url": null,
-      "git_ssh_url": "ssh://git@gitlab:2222/group/name.git",
-      "git_http_url": "https://gitlab/group/name.git",
+      "git_ssh_url": "ssh://git@gitlab.com:2222/group/name.git",
+      "git_http_url": "https://gitlab.com/group/name.git",
       "namespace": "group",
       "visibility_level": 1,
       "path_with_namespace": "group/name",
       "default_branch": "master",
       "ci_config_path": null,
-      "homepage": "https://gitlab/group/name",
-      "url": "ssh://git@gitlab:2222/group/name.git",
-      "ssh_url": "ssh://git@gitlab:2222/group/name.git",
-      "http_url": "https://gitlab/group/name.git"
+      "homepage": "https://gitlab.com/group/name",
+      "url": "ssh://git@gitlab.com:2222/group/name.git",
+      "ssh_url": "ssh://git@gitlab.com:2222/group/name.git",
+      "http_url": "https://gitlab.com/group/name.git"
     },
     "commits": [
       {
         "id": "bb0748feaa336d841c251017e4e374c22d0c8a98",
         "message": "Test commit message\n",
         "timestamp": "2020-01-06T03:47:55Z",
-        "url": "https://gitlab/group/name/commit/bb0748feaa336d841c251017e4e374c22d0c8a98",
+        "url": "https://gitlab.com/group/name/commit/bb0748feaa336d841c251017e4e374c22d0c8a98",
         "author": {
           "name": "User",
           "email": "[email protected]"
@@ -55,11 +55,11 @@
     },
     "repository": {
       "name": "name",
-      "url": "ssh://git@gitlab:2222/group/name.git",
+      "url": "ssh://git@gitlab.com:2222/group/name.git",
       "description": "",
-      "homepage": "https://gitlab/group/name",
-      "git_http_url": "https://gitlab/group/name.git",
-      "git_ssh_url": "ssh://git@gitlab:2222/group/name.git",
+      "homepage": "https://gitlab.com/group/name",
+      "git_http_url": "https://gitlab.com/group/name.git",
+      "git_ssh_url": "ssh://git@gitlab.com:2222/group/name.git",
       "visibility_level": 10
     }
   }

applicationset/webhook/webhook.go

@@ -27,6 +27,10 @@ import (
 	log "github.com/sirupsen/logrus"
 )
 
+// https://www.rfc-editor.org/rfc/rfc3986#section-3.2.1
+// https://github.com/shadow-maint/shadow/blob/master/libmisc/chkname.c#L36
+const usernameRegex = `[a-zA-Z0-9_\.][a-zA-Z0-9_\.-]{0,30}[a-zA-Z0-9_\.\$-]?`
+
 const payloadQueueSize = 50000
 
 var errBasicAuthVerificationFailed = errors.New("basic auth verification failed")
@@ -246,7 +250,10 @@ func getGitGeneratorInfo(payload interface{}) *gitGeneratorInfo {
 		log.Errorf("Failed to parse repoURL '%s'", webURL)
 		return nil
 	}
-	regexpStr := `(?i)(http://|https://|\w+@|ssh://(\w+@)?)` + urlObj.Hostname() + "(:[0-9]+|)[:/]" + urlObj.Path[1:] + "(\\.git)?"
+	regexEscapedHostname := regexp.QuoteMeta(urlObj.Hostname())
+	regexEscapedPath := regexp.QuoteMeta(urlObj.EscapedPath()[1:])
+	regexpStr := fmt.Sprintf(`(?i)^(http://|https://|%s@|ssh://(%s@)?((alt)?ssh\.)?)%s(:[0-9]+|)[:/]%s(\.git)?$`,
+		usernameRegex, usernameRegex, regexEscapedHostname, regexEscapedPath)
 	repoRegexp, err := regexp.Compile(regexpStr)
 	if err != nil {
 		log.Errorf("Failed to compile regexp for repoURL '%s'", webURL)
@@ -274,7 +281,9 @@ func getPRGeneratorInfo(payload interface{}) *prGeneratorInfo {
 			log.Errorf("Failed to parse repoURL '%s'", apiURL)
 			return nil
 		}
-		regexpStr := `(?i)(http://|https://|\w+@|ssh://(\w+@)?)` + urlObj.Hostname() + "(:[0-9]+|)[:/]"
+		regexEscapedHostname := regexp.QuoteMeta(urlObj.Hostname())
+		regexpStr := fmt.Sprintf(`(?i)^(http://|https://|%s@|ssh://(%s@)?)%s(:[0-9]+|)[:/]$`,
+			usernameRegex, usernameRegex, regexEscapedHostname)
 		apiRegexp, err := regexp.Compile(regexpStr)
 		if err != nil {
 			log.Errorf("Failed to compile regexp for repoURL '%s'", apiURL)

applicationset/webhook/webhook_test.go

@@ -63,7 +63,7 @@ func TestWebhookHandler(t *testing.T) {
 			headerKey:          "X-GitHub-Event",
 			headerValue:        "push",
 			payloadFile:        "github-commit-event.json",
-			effectedAppSets:    []string{"git-github", "matrix-git-github", "merge-git-github", "matrix-scm-git-github", "matrix-nested-git-github", "merge-nested-git-github", "plugin", "matrix-pull-request-github-plugin"},
+			effectedAppSets:    []string{"git-github", "git-github-ssh", "git-github-alt-ssh", "matrix-git-github", "merge-git-github", "matrix-scm-git-github", "matrix-nested-git-github", "merge-nested-git-github", "plugin", "matrix-pull-request-github-plugin"},
 			expectedStatusCode: http.StatusOK,
 			expectedRefresh:    true,
 		},
@@ -72,7 +72,7 @@ func TestWebhookHandler(t *testing.T) {
 			headerKey:          "X-GitHub-Event",
 			headerValue:        "push",
 			payloadFile:        "github-commit-branch-event.json",
-			effectedAppSets:    []string{"git-github", "plugin", "matrix-pull-request-github-plugin"},
+			effectedAppSets:    []string{"git-github", "git-github-ssh", "git-github-alt-ssh", "plugin", "matrix-pull-request-github-plugin"},
 			expectedStatusCode: http.StatusOK,
 			expectedRefresh:    true,
 		},
@@ -81,7 +81,7 @@ func TestWebhookHandler(t *testing.T) {
 			headerKey:          "X-GitHub-Event",
 			headerValue:        "ping",
 			payloadFile:        "github-ping-event.json",
-			effectedAppSets:    []string{"git-github", "plugin"},
+			effectedAppSets:    []string{"git-github", "git-github-ssh", "git-github-alt-ssh", "plugin"},
 			expectedStatusCode: http.StatusOK,
 			expectedRefresh:    false,
 		},
@@ -90,7 +90,7 @@ func TestWebhookHandler(t *testing.T) {
 			headerKey:          "X-Gitlab-Event",
 			headerValue:        "Push Hook",
 			payloadFile:        "gitlab-event.json",
-			effectedAppSets:    []string{"git-gitlab", "plugin", "matrix-pull-request-github-plugin"},
+			effectedAppSets:    []string{"git-gitlab", "git-gitlab-ssh", "git-gitlab-alt-ssh", "plugin", "matrix-pull-request-github-plugin"},
 			expectedStatusCode: http.StatusOK,
 			expectedRefresh:    true,
 		},
@@ -99,7 +99,7 @@ func TestWebhookHandler(t *testing.T) {
 			headerKey:          "X-Random-Event",
 			headerValue:        "Push Hook",
 			payloadFile:        "gitlab-event.json",
-			effectedAppSets:    []string{"git-gitlab", "plugin"},
+			effectedAppSets:    []string{"git-gitlab", "git-gitlab-ssh", "git-gitlab-alt-ssh", "plugin"},
 			expectedStatusCode: http.StatusBadRequest,
 			expectedRefresh:    false,
 		},
@@ -108,7 +108,7 @@ func TestWebhookHandler(t *testing.T) {
 			headerKey:          "X-Random-Event",
 			headerValue:        "Push Hook",
 			payloadFile:        "invalid-event.json",
-			effectedAppSets:    []string{"git-gitlab", "plugin"},
+			effectedAppSets:    []string{"git-gitlab", "git-gitlab-ssh", "git-gitlab-alt-ssh", "plugin"},
 			expectedStatusCode: http.StatusBadRequest,
 			expectedRefresh:    false,
 		},
@@ -190,7 +190,11 @@ func TestWebhookHandler(t *testing.T) {
 		t.Run(test.desc, func(t *testing.T) {
 			fc := fake.NewClientBuilder().WithScheme(scheme).WithObjects(
 				fakeAppWithGitGenerator("git-github", namespace, "https://github.com/org/repo"),
-				fakeAppWithGitGenerator("git-gitlab", namespace, "https://gitlab/group/name"),
+				fakeAppWithGitGenerator("git-github-ssh", namespace, "ssh://[email protected]/org/repo"),
+				fakeAppWithGitGenerator("git-github-alt-ssh", namespace, "ssh://[email protected]:443/org/repo"),
+				fakeAppWithGitGenerator("git-gitlab", namespace, "https://gitlab.com/group/name"),
+				fakeAppWithGitGenerator("git-gitlab-ssh", namespace, "ssh://[email protected]/group/name"),
+				fakeAppWithGitGenerator("git-gitlab-alt-ssh", namespace, "ssh://[email protected]:443/group/name"),
 				fakeAppWithGitGenerator("git-azure-devops", namespace, "https://dev.azure.com/fabrikam-fiber-inc/DefaultCollection/_git/Fabrikam-Fiber-Git"),
 				fakeAppWithGithubPullRequestGenerator("pull-request-github", namespace, "CodErTOcat", "Hello-World"),
 				fakeAppWithGitlabPullRequestGenerator("pull-request-gitlab", namespace, "100500"),

util/webhook/webhook.go

@@ -347,7 +347,7 @@ func getWebUrlRegex(webURL string) (*regexp.Regexp, error) {
 
 	regexEscapedHostname := regexp.QuoteMeta(urlObj.Hostname())
 	regexEscapedPath := regexp.QuoteMeta(urlObj.EscapedPath()[1:])
-	regexpStr := fmt.Sprintf(`(?i)^(http://|https://|%s@|ssh://(%s@)?)%s(:[0-9]+|)[:/]%s(\.git)?$`,
+	regexpStr := fmt.Sprintf(`(?i)^(http://|https://|%s@|ssh://(%s@)?((alt)?ssh\.)?)%s(:[0-9]+|)[:/]%s(\.git)?$`,
 		usernameRegex, usernameRegex, regexEscapedHostname, regexEscapedPath)
 	repoRegexp, err := regexp.Compile(regexpStr)
 	if err != nil {

util/webhook/webhook_test.go

@@ -616,10 +616,13 @@ func Test_getWebUrlRegex(t *testing.T) {
 		{false, "https://example.com/org/repo", "https://example.com/org/repo-2", "partial match should not match"},
 		{true, "https://example.com/org/repo", "https://example.com/org/repo.git", "no .git should match with .git"},
 		{true, "https://example.com/org/repo", "[email protected]:org/repo", "git without protocol should match"},
-		{true, "https://example.com/org/repo", "[email protected]:org/repo", "git with non-git username shout match"},
+		{true, "https://example.com/org/repo", "[email protected]:org/repo", "git with non-git username should match"},
 		{true, "https://example.com/org/repo", "ssh://[email protected]/org/repo", "git with protocol should match"},
 		{true, "https://example.com/org/repo", "ssh://[email protected]:22/org/repo", "git with port number should match"},
 		{true, "https://example.com:443/org/repo", "ssh://[email protected]:22/org/repo", "https and ssh w/ different port numbers should match"},
+		{true, "https://example.com:443/org/repo", "ssh://[email protected]:443/org/repo", "https and ssh w/ ssh subdomain should match"},
+		{true, "https://example.com:443/org/repo", "ssh://[email protected]:443/org/repo", "https and ssh w/ altssh subdomain should match"},
+		{false, "https://example.com:443/org/repo", "ssh://[email protected]:443/org/repo", "https and ssh w/ unknown subdomain should not match"},
 		{true, "https://example.com/org/repo", "ssh://[email protected]/org/repo", "valid usernames with hyphens in repo should match"},
 		{false, "https://example.com/org/repo", "ssh://[email protected]/org/repo", "invalid usernames with hyphens in repo should not match"},
 		{true, "https://example.com:443/org/repo", "[email protected]:22:ORG/REPO", "matches aren't case-sensitive"},