git/gitlab: default project webhooks to SSL verification when creating hooks
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 365
- Forks
- 223
- Avg merge
- 2d 3h
- Merged PRs (30d)
- 25
Description
Summary
pkg/git/gitlab/gitlab.go creates project hooks with EnableSSLVerification set to false (&f), which disables TLS certificate verification for the webhook URL.
webhook := &gitlab.AddProjectHookOptions{
EnableSSLVerification: &f,
PushEvents: &t,
Token: &webhookSecret,
URL: &payloadURL,
}
Problem
For HTTPS payload URLs, disabling SSL verification is an insecure default and is inconsistent with tightening GitHub repository webhooks (pkg/git/github).
Proposal
Default EnableSSLVerification to true for HTTPS webhook targets (or always true unless an explicit opt-in exists for dev/self-signed).
This idea came as followup of #3714
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start in pkg/git/gitlab/gitlab.go at the project hook options and compare the webhook setup with pkg/git/github. Confirm the intended behavior for HTTPS payload URLs, then verify the resulting project hook configuration and any relevant existing tests. Done means newly created GitLab hooks no longer disable SSL certificate verification by default.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- gitlab, go
- Domain
- security
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 72/100