Rules / GL016

GL016 Insecure transport in URLs (HTTP, git://)

Severity: varies by context (see below)
OWASP: CICD-SEC-3 – Dependency Chain Abuse

What glsec checks

glsec flags plaintext transports — HTTP and git's legacy git:// protocol — in security-sensitive locations. Severity depends on context:

Location	Severity	Risk
`include: remote: http://...`	`error`	MITM attacker injects arbitrary pipeline configuration
`curl http://...` / `wget http://...` in scripts	`warn`	MITM attacker serves malicious content
`git clone/fetch/pull/remote add/submodule add http://...` in scripts	`warn`	MITM attacker serves modified source
`git://...` anywhere in a script line	`warn`	Plaintext and unauthenticated — no server identity check at all
`variables:` value with `http://` or `git://`	`warn` (public) / `info` (private)	Credential or data interception

git:// is git's daemon protocol. It offers neither encryption nor server authentication, so an attacker on the path can substitute the repository contents outright. Major forges dropped support for it years ago; a surviving git:// URL in a pipeline is usually stale configuration pointing at something that no longer answers — or at an internal daemon nobody has reviewed.

Host classification

Host type	Behavior
`localhost`, `127.0.0.1`, `::1`	Always ignored
Configured in `trusted-hosts:`	Always ignored
RFC 1918 IPs (`10.x`, `172.16–31.x`, `192.168.x`)	Downgraded to `info`
`.local`, `.internal`, `.corp`, `.lan` TLDs	Downgraded to `info`
All other public hosts	Full severity per table above

Trigger example

include:
  - remote: "http://templates.example.com/ci.yml"   # error

build:
  script:
    - curl http://install.example.com/tool.sh -o tool.sh   # warn
    - git clone http://git.example.com/vendor/lib.git      # warn
    - git clone git://git.example.com/vendor/tool.git      # warn

variables:
  REGISTRY: "http://nexus.internal/repo"   # info — internal host

Safe alternative

include:
  - remote: "https://templates.example.com/ci.yml"

build:
  script:
    - curl https://install.example.com/tool.sh -o tool.sh
    - echo "abc123…  tool.sh" | sha256sum --check
    - bash tool.sh
    - git clone https://git.example.com/vendor/lib.git

For git remotes, ssh:// is equally acceptable — both authenticate the server.

Enterprise allowlist

In corporate environments, internal registries or Artifactory instances may intentionally use HTTP. Add them to .glsec.yml to suppress findings:

trusted-hosts:
  - nexus.internal
  - registry.corp.example.com
  - 10.0.0.0/8          # RFC 1918 — private network CIDR
  - 192.168.0.0/16

Hosts and CIDRs on the allowlist are never flagged regardless of protocol.