Harden nuget per-request index rewrite #149

Merged
benvin merged 10 commits from benvin/nuget-followups into master 2026-10-17 21:39:42 +11:00

10 Commits

Author SHA1 Message Date
unkin-agent d92f7cca5a Merge remote-tracking branch 'origin/master' into benvin/nuget-followups
ci/woodpecker/pr/pre-commit Pipeline was successful
ci/woodpecker/pr/build Pipeline was successful
ci/woodpecker/pr/test Pipeline was successful
# Conflicts:
#	e2e/head_test.go
#	internal/api/v1/proxy.go
2026-10-17 21:25:26 +11:00
unkin-agent 29f335c364 Document new nuget immutable blob classes
ci/woodpecker/pr/pre-commit Pipeline was successful
ci/woodpecker/pr/test Pipeline was successful
ci/woodpecker/pr/build Pipeline was successful
2026-10-17 17:12:46 +11:00
unkin-agent f4e0a6a7de Merge remote-tracking branch 'origin/master' into benvin/nuget-followups
# Conflicts:
#	internal/provider/provider.go
2026-10-17 17:08:25 +11:00
unkin-agent c3862fbd5f Merge remote-tracking branch 'origin/benvin/remote-head-route' into benvin/nuget-followups
ci/woodpecker/pr/pre-commit Pipeline was successful
ci/woodpecker/pr/test Pipeline was successful
ci/woodpecker/pr/build Pipeline was successful
2026-10-17 13:01:01 +11:00
unkin-agent 7769902530 Fetch rewritten mutable responses on HEAD to match GET length
ci/woodpecker/pr/pre-commit Pipeline was successful
ci/woodpecker/pr/test Pipeline was successful
ci/woodpecker/pr/build Pipeline was successful
2026-10-17 12:59:33 +11:00
unkin-agent fe10a50d27 Share strict X-Forwarded-Proto parsing and reject empty Host ports
ci/woodpecker/pr/pre-commit Pipeline was successful
ci/woodpecker/pr/test Pipeline was successful
ci/woodpecker/pr/build Pipeline was successful
2026-10-17 12:56:29 +11:00
unkin-agent d0c30e145e Merge remote-tracking branch 'origin/benvin/remote-head-route' into benvin/nuget-followups 2026-10-17 12:48:05 +11:00
unkin-agent a7aa37982a Leave remote HEAD routing to the generic HEAD fix
ci/woodpecker/pr/pre-commit Pipeline was successful
ci/woodpecker/pr/test Pipeline was successful
ci/woodpecker/pr/build Pipeline was successful
2026-10-17 12:43:01 +11:00
unkin-agent 3dd4acd233 Add HEAD route for remotes matching GET headers
ci/woodpecker/pr/pre-commit Pipeline was successful
ci/woodpecker/pr/test Pipeline was successful
ci/woodpecker/pr/build Pipeline was successful
2026-10-17 12:40:33 +11:00
unkin-agent 3b69b58ba3 Harden nuget per-request rewrite and fix HEAD length
- set Cache-Control no-store and Vary on rewritten responses
- accept only http/https X-Forwarded-Proto
- reject invalid Host headers and JSON-escape the injected base URL
- route remote HEAD and serve rewritten HEAD via the GET path
- classify snupkg, readme and icon as immutable
2026-10-17 12:39:02 +11:00