fix: security issue

Signed-off-by: Umberto Sgueglia <usgueglia@contractor.linuxfoundation.org>

Author: ulemons

services/apps/packages_worker/src/maven/__tests__/registry.test.ts

@@ -2,7 +2,10 @@ import { describe, expect, it } from 'vitest'
 
 import {
   GRADLE_PLUGIN_PORTAL_BASE_URL,
+  JITPACK_BASE_URL,
   MAVEN_CENTRAL_BASE_URL,
+  isJitpackNamespace,
+  jitpackPageUrl,
   resolveRegistryBaseUrl,
   resolveRegistryPageUrl,
   resolveRegistryPageUrlFromBase,
@@ -150,19 +153,19 @@ describe('resolveRegistryBaseUrl', () => {
     )
   })
 
-  it('returns JitPack for io.github namespace', () => {
-    expect(resolveRegistryBaseUrl('io.github.resilience4j')).toBe('https://jitpack.io')
+  it('returns Maven Central for io.github namespace (JitPack is a fallback, not primary)', () => {
+    expect(resolveRegistryBaseUrl('io.github.resilience4j')).toBe(MAVEN_CENTRAL_BASE_URL)
   })
 
-  it('returns JitPack for bare io.github (exact match)', () => {
-    expect(resolveRegistryBaseUrl('io.github')).toBe('https://jitpack.io')
+  it('returns Maven Central for bare io.github', () => {
+    expect(resolveRegistryBaseUrl('io.github')).toBe(MAVEN_CENTRAL_BASE_URL)
   })
 
-  it('returns JitPack for com.github namespace', () => {
-    expect(resolveRegistryBaseUrl('com.github.ben-manes')).toBe('https://jitpack.io')
+  it('returns Maven Central for com.github namespace (JitPack is a fallback, not primary)', () => {
+    expect(resolveRegistryBaseUrl('com.github.ben-manes')).toBe(MAVEN_CENTRAL_BASE_URL)
   })
 
-  it('does not match io.githubfoo — prefix boundary must end at a dot', () => {
+  it('returns Maven Central for io.githubfoo (no dot boundary)', () => {
     expect(resolveRegistryBaseUrl('io.githubfoo')).toBe(MAVEN_CENTRAL_BASE_URL)
   })
 })
@@ -192,21 +195,17 @@ describe('resolveRegistryPageUrl', () => {
     )
   })
 
-  it('returns JitPack browse URL for io.github', () => {
+  it('returns Maven Central URL for io.github (Central is primary)', () => {
     expect(resolveRegistryPageUrl('io.github.resilience4j', 'resilience4j-core')).toBe(
-      'https://jitpack.io/#resilience4j/resilience4j-core',
+      'https://central.sonatype.com/artifact/io.github.resilience4j/resilience4j-core',
     )
   })
 
-  it('returns JitPack browse URL for com.github', () => {
+  it('returns Maven Central URL for com.github (Central is primary)', () => {
     expect(resolveRegistryPageUrl('com.github.ben-manes', 'caffeine')).toBe(
-      'https://jitpack.io/#ben-manes/caffeine',
+      'https://central.sonatype.com/artifact/com.github.ben-manes/caffeine',
     )
   })
-
-  it('returns JitPack browse URL for bare io.github prefix without leaking the prefix into the path', () => {
-    expect(resolveRegistryPageUrl('io.github', 'some-lib')).toBe('https://jitpack.io/#/some-lib')
-  })
 })
 
 describe('resolveRegistryPageUrlFromBase', () => {
@@ -236,4 +235,55 @@ describe('resolveRegistryPageUrlFromBase', () => {
       ),
     ).toBe('https://plugins.gradle.org/m2/io/github/trueangle/gradle-plugin/')
   })
+
+  it('returns JitPack browse URL when resolvedBaseUrl is JitPack', () => {
+    expect(
+      resolveRegistryPageUrlFromBase('io.github.trueangle', 'gradle-plugin', JITPACK_BASE_URL),
+    ).toBe('https://jitpack.io/#trueangle/gradle-plugin')
+  })
+})
+
+describe('isJitpackNamespace', () => {
+  it('returns true for io.github.* packages', () => {
+    expect(isJitpackNamespace('io.github.resilience4j')).toBe(true)
+  })
+
+  it('returns true for bare io.github', () => {
+    expect(isJitpackNamespace('io.github')).toBe(true)
+  })
+
+  it('returns true for com.github.* packages', () => {
+    expect(isJitpackNamespace('com.github.ben-manes')).toBe(true)
+  })
+
+  it('returns true for bare com.github', () => {
+    expect(isJitpackNamespace('com.github')).toBe(true)
+  })
+
+  it('returns false for io.githubfoo (no dot boundary)', () => {
+    expect(isJitpackNamespace('io.githubfoo')).toBe(false)
+  })
+
+  it('returns false for unrelated namespaces', () => {
+    expect(isJitpackNamespace('org.apache.commons')).toBe(false)
+    expect(isJitpackNamespace('io.jenkins.plugins')).toBe(false)
+  })
+})
+
+describe('jitpackPageUrl', () => {
+  it('strips io.github. prefix from groupId', () => {
+    expect(jitpackPageUrl('io.github.resilience4j', 'resilience4j-core')).toBe(
+      'https://jitpack.io/#resilience4j/resilience4j-core',
+    )
+  })
+
+  it('strips com.github. prefix from groupId', () => {
+    expect(jitpackPageUrl('com.github.ben-manes', 'caffeine')).toBe(
+      'https://jitpack.io/#ben-manes/caffeine',
+    )
+  })
+
+  it('handles bare io.github with no sub-namespace', () => {
+    expect(jitpackPageUrl('io.github', 'some-lib')).toBe('https://jitpack.io/#/some-lib')
+  })
 })

services/apps/packages_worker/src/maven/metadata.ts

@@ -12,7 +12,7 @@ import axios from 'axios'
 import { XMLParser } from 'fast-xml-parser'
 
 import { isPrerelease } from './normalize'
-import { resolveRegistryBaseUrl } from './registry'
+import { JITPACK_BASE_URL, resolveRegistryBaseUrl } from './registry'
 
 const REQUEST_TIMEOUT_MS = 10_000
 const MAX_RETRIES = 3
@@ -115,7 +115,7 @@ export async function resolveVersionsList(
         // that don't exist as public builds. Scoped to JitPack only — other
         // registries may return 401 for auth failures, which should not be
         // silently treated as a missing package.
-        if (status === 404 || (status === 401 && url.includes('jitpack.io')))
+        if (status === 404 || (status === 401 && url.startsWith(JITPACK_BASE_URL + '/')))
           return { kind: 'NOT_FOUND' }
         // 429 = explicit rate limit, 403 = CDN throttle (Maven Central uses both)
         if ((status === 429 || status === 403) && attempt < MAX_RETRIES) {

services/apps/packages_worker/src/maven/registry.ts

@@ -9,10 +9,17 @@
  *
  * All these repos expose the standard Maven repository layout, so the same
  * metadata.xml / POM fetch logic works — only the base URL changes.
+ *
+ * JitPack (io.github.*, com.github.*) is NOT listed here as a primary registry
+ * because many well-known artifacts under those prefixes are published on Maven
+ * Central (e.g. io.github.resilience4j, com.github.ben-manes:caffeine). Maven
+ * Central is tried first; JitPack is used only as a fallback when Central returns
+ * NOT_FOUND (see the enrichment loop).
  */
 
 export const MAVEN_CENTRAL_BASE_URL = 'https://repo1.maven.org/maven2'
 export const GRADLE_PLUGIN_PORTAL_BASE_URL = 'https://plugins.gradle.org/m2'
+export const JITPACK_BASE_URL = 'https://jitpack.io'
 
 interface RegistryEntry {
   prefix: string
@@ -100,21 +107,6 @@ const ALTERNATIVE_REGISTRIES: RegistryEntry[] = [
     baseUrl: GRADLE_PLUGIN_PORTAL_BASE_URL,
     pageUrl: (g, a) => `${GRADLE_PLUGIN_PORTAL_BASE_URL}/${g.replace(/\./g, '/')}/${a}/`,
   },
-  // JitPack builds and serves artifacts directly from GitHub/GitLab/Bitbucket source repos.
-  // The io.github.<username> and com.github.<username> groupId conventions are JitPack-specific
-  // and will never resolve on Maven Central.
-  {
-    prefix: 'io.github',
-    baseUrl: 'https://jitpack.io',
-    pageUrl: (g, a) =>
-      `https://jitpack.io/#${g.startsWith('io.github.') ? g.slice('io.github.'.length) : ''}/${a}`,
-  },
-  {
-    prefix: 'com.github',
-    baseUrl: 'https://jitpack.io',
-    pageUrl: (g, a) =>
-      `https://jitpack.io/#${g.startsWith('com.github.') ? g.slice('com.github.'.length) : ''}/${a}`,
-  },
   {
     prefix: 'com.cloudbees.plugins',
     baseUrl: 'https://repo.jenkins-ci.org/public',
@@ -182,6 +174,30 @@ export function isAlternativeRegistry(groupId: string): boolean {
   return findEntry(groupId) !== undefined
 }
 
+/**
+ * Returns true for io.github.* and com.github.* groupIds — the JitPack namespace
+ * convention. Maven Central is tried first for these; JitPack is the fallback.
+ */
+export function isJitpackNamespace(groupId: string): boolean {
+  return (
+    groupId === 'io.github' ||
+    groupId.startsWith('io.github.') ||
+    groupId === 'com.github' ||
+    groupId.startsWith('com.github.')
+  )
+}
+
+/** Returns a human-browsable JitPack URL for an io.github.* or com.github.* artifact. */
+export function jitpackPageUrl(groupId: string, artifactId: string): string {
+  if (groupId.startsWith('io.github.')) {
+    return `${JITPACK_BASE_URL}/#${groupId.slice('io.github.'.length)}/${artifactId}`
+  }
+  if (groupId.startsWith('com.github.')) {
+    return `${JITPACK_BASE_URL}/#${groupId.slice('com.github.'.length)}/${artifactId}`
+  }
+  return `${JITPACK_BASE_URL}/#/${artifactId}`
+}
+
 /**
  * Returns a human-browsable URL for the given artifact in its authoritative registry.
  */
@@ -211,5 +227,8 @@ export function resolveRegistryPageUrlFromBase(
   if (resolvedBaseUrl === GRADLE_PLUGIN_PORTAL_BASE_URL) {
     return `${GRADLE_PLUGIN_PORTAL_BASE_URL}/${groupId.replace(/\./g, '/')}/${artifactId}/`
   }
+  if (resolvedBaseUrl === JITPACK_BASE_URL) {
+    return jitpackPageUrl(groupId, artifactId)
+  }
   return resolveRegistryPageUrl(groupId, artifactId)
 }

services/apps/packages_worker/src/maven/runMavenEnrichmentLoop.ts

@@ -20,8 +20,10 @@ import { isMavenFetchError, resolveVersionsList } from './metadata'
 import { isPrerelease, parseRepoUrl } from './normalize'
 import {
   GRADLE_PLUGIN_PORTAL_BASE_URL,
+  JITPACK_BASE_URL,
   MAVEN_CENTRAL_BASE_URL,
   isAlternativeRegistry,
+  isJitpackNamespace,
   resolveRegistryBaseUrl,
   resolveRegistryPageUrl,
   resolveRegistryPageUrlFromBase,
@@ -142,6 +144,19 @@ async function processCriticalPackage(qx: QueryExecutor, pkg: PackageRow, forceF
     }
   }
 
+  // Second fallback: JitPack for io.github.* / com.github.* packages not found on
+  // Maven Central. These namespaces are also used by well-known Central artifacts
+  // (e.g. resilience4j, caffeine), so Central is tried first; JitPack is the fallback
+  // for packages that genuinely live only on JitPack.
+  if (isMavenFetchError(metadata) && metadata.kind === 'NOT_FOUND' && isJitpackNamespace(groupId)) {
+    const jitpackMetadata = await resolveVersionsList(groupId, artifactId, JITPACK_BASE_URL)
+    if (!isMavenFetchError(jitpackMetadata)) {
+      log.info({ groupId, artifactId }, 'Not found on Maven Central — resolved via JitPack fallback')
+      baseUrl = JITPACK_BASE_URL
+      metadata = jitpackMetadata
+    }
+  }
+
   // Third fallback: Gradle Plugin Portal. Plugins can be published under any groupId
   // (not just gradle.plugin.*), so this is worth trying for all NOT_FOUND packages.
   // Skip when GPP is already the primary registry (gradle.plugin.*) to avoid a