From 13e95f4ace3c5600d7341ae3ab98e291a22e50d5 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=EC=9D=B4=EB=9E=91=EC=9D=B4?= <erang@nabomhalang.co.kr>
Date: Fri, 10 Apr 2026 21:52:11 +0900
Subject: [PATCH] =?UTF-8?q?feat(rails):=20GIT=5FRAW=5FALLOWED=5FHOSTS=20en?=
 =?UTF-8?q?v=20=EB=A1=9C=20=ED=8C=8C=EC=9D=BC=20=ED=94=84=EB=A1=9D?=
 =?UTF-8?q?=EC=8B=9C=20allowlist=20=EC=99=B8=EB=B6=80=ED=99=94?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- 기존에는 git.nabomhalang.co.kr 한 곳만 하드코딩되어 있었음
- GIT_RAW_ALLOWED_HOSTS=comma,separated,hosts 로 여러 호스트 지원
- 기본값은 기존과 동일 (git.nabomhalang.co.kr) — 행동 변화 없음
- hanarang-rails v0.1.3 의 외부 배포 친화 패키지와 세트
---
 backend/src/rails/rails.service.ts | 18 ++++++++++++++----
 1 file changed, 14 insertions(+), 4 deletions(-)

diff --git a/backend/src/rails/rails.service.ts b/backend/src/rails/rails.service.ts
index 3e02393..8dcc9ee 100644
--- a/backend/src/rails/rails.service.ts
+++ b/backend/src/rails/rails.service.ts
@@ -96,18 +96,28 @@ export class RailsService {
   }
 
   /**
-   * Fetch raw file content from the internal Gitea. Restricted to the
-   * Gitea host for safety.
+   * Fetch raw file content from a Git host. Restricted to an allowlist
+   * of hosts for SSRF safety.
+   *
+   * Allowlist is configured via env var GIT_RAW_ALLOWED_HOSTS — comma
+   * separated. Defaults to the hanarang-internal Gitea instance.
    */
   async fetchFileContent(rawUrl: string): Promise<string | null> {
-    const allowedHost = 'git.nabomhalang.co.kr';
+    const allowedHosts = (
+      this.config.get<string>('GIT_RAW_ALLOWED_HOSTS') ??
+      'git.nabomhalang.co.kr'
+    )
+      .split(',')
+      .map((h) => h.trim())
+      .filter(Boolean);
+
     let parsed: URL;
     try {
       parsed = new URL(rawUrl);
     } catch {
       return null;
     }
-    if (parsed.host !== allowedHost) return null;
+    if (!allowedHosts.includes(parsed.host)) return null;
 
     try {
       const controller = new AbortController();