From b2e29871fdce958c1fd04954e801a0046fd4f017 Mon Sep 17 00:00:00 2001 From: jochen Date: Tue, 22 Sep 2026 21:56:51 +0200 Subject: [PATCH] Protect the address the builder sends its registry password to MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit `at` was settable. A node setting could point the builder's package binding at any host, and the builder sends its registry credential there as basic auth — so a setting meant for a port was a way to hand the password to somebody else. novox/hq 04-ISSUES/085 --- modules/builder/module.json | 1 + 1 file changed, 1 insertion(+) diff --git a/modules/builder/module.json b/modules/builder/module.json index adf5dc7..6d02dfd 100644 --- a/modules/builder/module.json +++ b/modules/builder/module.json @@ -49,6 +49,7 @@ "protected": [ "provision", "from", + "at", "as" ], "content": "{\"provision\": \"package-registry\", \"from\": \"gitea\", \"at\": \"127.0.0.1\", \"as\": \"mesh-builder\", \"serves\": {\"scheme\": \"http\", \"port\": 3000, \"npm-path\": \"/api/packages/novox/npm/\"}}\n"