Remove hard coded credentials from git remote reference

Updates, 2024-09-11 -- @hoegaarden

Further investigation showed:

• this leak only occurs with relative old versions of the docker image, newer verions don't show this behavior
• other images / system however, night still pick up the the URL and thus might leak the creds elsewhere

Thus we

• want to move to using a header instead of creds in the URLs, as per @hacks4oats suggestion
  • potentially based on / influenced by
    • https://gitlab.com/gitlab-org/security/gitlab-runner/-/merge_requests/67
    • https://gitlab.com/gitlab-org/security/gitlab-runner/-/commit/0eabd8fc09c3145221cc8542127b862b56b4583f (branch sec/hhoerl/29655-no-cred-leaks)
  • so that we limit exposure of creds
  • and thus decrease the potential of similar leaks in the future
• test this new behaviour with different executors
  • to ensure they all pick up the creds from the git config (vs. from the URL)

---

Summary

I discovered a security issue in the latest release of moby/buildkit where the ephemeral $CI_JOB_TOKEN was leaked during the SLSA attestation generation it provides. I've investigated this briefly and discovered that the token is inserted into the remote URL as part of GetRemoteURL. The job token is short-lived, so this leakage does not pose a large risk, but in my opinion it would be best to send the required credentials as a header instead.

Steps to reproduce

See this comment and the config.toml & .gitlab-ci.yaml therein.

Actual behavior

The remote URL leaks the username and temporary token used to fetch the repository for the job.

Expected behavior

The remote URL does not include the username and password, and instead adds an extra header with the basic authorization credentials in the git config.

Relevant logs and/or screenshots

Environment description

config.toml contents

Add your configuration here

Running on GitLab SaaS.

Used GitLab Runner version

Possible fixes

Using the credentials inside the URI is deprecated behavior according to RFC 3986 Section 3.2.1.

# Use exec.Cmd to generate the equivalent of the following command.
# See the resource below for more info on the config changes.
# https://git-scm.com/docs/git-config#Documentation/git-config.txt-httpextraHeader
#
# <value> - is the base64 encoded value of the `user:pass` combination.
$ git config http.extraHeader 'Authorization: Basic <value>