dl-git-repo-safe

⚠️ Security Notice: This is a security-patched fork of download-git-repo. It replaces the vulnerable git-clone dependency with git-clone-safe to fix CVE-2022-25900 (command injection via git clone).

Download and extract a git repository (GitHub, GitLab, Bitbucket) from node.

What Changed?

| | download-git-repo (original) | dl-git-repo-safe (this fork) | |---|---|---| | git-clone | ^0.1.0 (vulnerable) | replaced with git-clone-safe@^1.2.0 | | CVE-2022-25900 | Affected | Fixed | | API | — | 100% compatible (drop-in replacement) |

CVE-2022-25900

The original download-git-repo depends on git-clone@^0.1.0, which is vulnerable to command injection. An attacker can craft a malicious repository URL that executes arbitrary commands on the system. This fork replaces git-clone with git-clone-safe, which properly sanitizes git clone arguments.

Migration

Replace download-git-repo with dl-git-repo-safe:

npm uninstall download-git-repo
npm install dl-git-repo-safe

Or use npm/yarn overrides to replace it transitively:

{
  "overrides": {
    "download-git-repo": "npm:dl-git-repo-safe@^1.0.0"
  }
}

No code changes required — the API is identical.

Installation

$ npm install dl-git-repo-safe

API

download(repository, destination, options, callback)

Download a git repository to a destination folder with options, and callback.

repository

The shorthand repository string to download the repository from:

• GitHub - github:owner/name or simply owner/name
• GitLab - gitlab:owner/name
• Bitbucket - bitbucket:owner/name

The repository parameter defaults to the master branch, but you can specify a branch or tag as a URL fragment like owner/name#my-branch. In addition to specifying the type of where to download, you can also specify a custom origin like gitlab:custom.com:owner/name. Custom origin will default to https or git@ for http and clone downloads respectively, unless protocol is specified. Feel free to submit an issue or pull request for additional origin options.

In addition to having the shorthand for supported git hosts, you can also hit a repository directly with:

• Direct - direct:url

This will bypass the shorthand normalizer and pass url directly. If using direct without clone, you must pass the full url to the zip file, including paths to branches if needed. If using direct with clone, you must pass the full url to the git repo and you can specify a branch like direct:url#my-branch.

destination

The file path to download the repository to.

options

An optional options object parameter with download options. Options include:

• clone - boolean default false - If true use git clone instead of an http download. While this can be a bit slower, it does allow private repositories to be used if the appropriate SSH keys are setup.
• All other options (proxy, headers, filter, etc.) will be passed down accordingly and may override defaults
  • Additional download options: https://github.com/kevva/download#options
  • Additional clone options: https://github.com/jaz303/git-clone#clonerepo-targetpath-options-cb

callback

The callback function as function (err).

Examples

Shorthand

Using http download from Github repository at master.

var download = require('dl-git-repo-safe')
download('flippidippi/download-git-repo-fixture', 'test/tmp', function (err) {
  console.log(err ? 'Error' : 'Success')
})

Using git clone from Bitbucket repository at my-branch.

download('bitbucket:flippidippi/download-git-repo-fixture#my-branch', 'test/tmp', { clone: true }, function (err) {
  console.log(err ? 'Error' : 'Success')
})

Using http download from GitLab repository with custom origin and token.

download('gitlab:mygitlab.com:flippidippi/download-git-repo-fixture#my-branch', 'test/tmp', { headers: { 'PRIVATE-TOKEN': '1234' } }, function (err) {
  console.log(err ? 'Error' : 'Success')
})

Using git clone from GitLab repository with custom origin and protocol. Note that the repository type (github, gitlab etc.) is not required if cloning from a custom origin.

download('https://mygitlab.com:flippidippi/download-git-repo-fixture#my-branch', 'test/tmp', { clone: true }, function (err) {
  console.log(err ? 'Error' : 'Success')
})

Direct

Using http download from direct url.

download('direct:https://gitlab.com/flippidippi/download-git-repo-fixture/repository/archive.zip', 'test/tmp', function (err) {
  console.log(err ? 'Error' : 'Success')
})

Using git clone from direct url at master.

download('direct:https://gitlab.com/flippidippi/download-git-repo-fixture.git', 'test/tmp', { clone: true }, function (err) {
  console.log(err ? 'Error' : 'Success')
})

Using git clone from direct url at my-branch.

download('direct:https://gitlab.com/flippidippi/download-git-repo-fixture.git#my-branch', 'test/tmp', { clone: true }, function (err) {
  console.log(err ? 'Error' : 'Success')
})

Verification

To confirm git-clone-safe is installed instead of git-clone:

npm ls git-clone git-clone-safe
npm audit

License

MIT