Add opt-in SSRF validation to Apps-Engine HTTP accessor by Copilot · Pull Request #38730 · RocketChat/Rocket.Chat

Copilot · 2026-02-16T17:03:17Z

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.

changeset-bot · 2026-02-16T17:03:23Z

⚠️ No Changeset found

Latest commit: 41c9a03

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

dionisio-bot · 2026-02-16T17:03:23Z

Looks like this PR is not ready to merge, because of the following issues:

This PR is missing the 'stat: QA assured' label
This PR is missing the required milestone or project
This PR has an invalid title

Please fix the issues and try again

If you have any trouble, please check the PR guidelines

Co-authored-by: d-gubert <1810309+d-gubert@users.noreply.github.com>

github-actions · 2026-02-16T17:39:59Z

📦 Docker Image Size Report

📈 Changes

Service	Current	Baseline	Change
sum of all images	1.1GiB	1.1GiB	+11MiB
rocketchat	360MiB	349MiB	+11MiB
omnichannel-transcript-service	134MiB	134MiB	-992B
queue-worker-service	134MiB	134MiB	+194B
ddp-streamer-service	128MiB	128MiB	-1.2KiB
account-service	115MiB	115MiB	-37B
authorization-service	112MiB	112MiB	-1.1KiB
presence-service	112MiB	112MiB	-187B

📊 Historical Trend

---
config:
  theme: "dark"
  xyChart:
    width: 900
    height: 400
---
xychart
  title "Image Size Evolution by Service (Last 30 Days + This PR)"
  x-axis ["11/24 17:34", "11/27 22:32", "11/28 19:05", "12/01 23:01", "12/02 21:57", "12/03 21:00", "12/04 18:17", "12/05 21:56", "12/08 20:15", "12/09 22:17", "12/10 23:26", "12/11 21:56", "12/12 22:45", "12/13 01:34", "12/15 22:31", "12/16 22:18", "12/17 21:04", "12/18 23:12", "12/19 23:27", "12/20 21:03", "12/22 18:54", "12/23 16:16", "12/24 19:38", "12/25 17:51", "12/26 13:18", "12/29 19:01", "12/30 20:52", "02/12 22:57", "02/13 22:38", "02/16 14:04", "02/17 15:11 (PR)"]
  y-axis "Size (GB)" 0 --> 0.5
  line "account-service" [0.11, 0.11, 0.11, 0.11, 0.11, 0.11, 0.11, 0.11, 0.11, 0.11, 0.11, 0.11, 0.11, 0.11, 0.11, 0.11, 0.11, 0.11, 0.11, 0.11, 0.11, 0.11, 0.11, 0.11, 0.11, 0.11, 0.11, 0.11, 0.11, 0.11, 0.11]
  line "authorization-service" [0.11, 0.11, 0.11, 0.11, 0.11, 0.11, 0.11, 0.11, 0.11, 0.11, 0.11, 0.11, 0.11, 0.11, 0.11, 0.11, 0.11, 0.11, 0.11, 0.11, 0.11, 0.11, 0.11, 0.11, 0.11, 0.11, 0.11, 0.11, 0.11, 0.11, 0.11]
  line "ddp-streamer-service" [0.12, 0.12, 0.12, 0.12, 0.12, 0.12, 0.12, 0.12, 0.12, 0.12, 0.12, 0.12, 0.12, 0.12, 0.12, 0.12, 0.12, 0.12, 0.12, 0.12, 0.12, 0.12, 0.12, 0.12, 0.12, 0.12, 0.12, 0.12, 0.12, 0.12, 0.12]
  line "omnichannel-transcript-service" [0.13, 0.13, 0.13, 0.13, 0.13, 0.13, 0.13, 0.13, 0.13, 0.13, 0.13, 0.13, 0.13, 0.13, 0.13, 0.13, 0.13, 0.13, 0.13, 0.13, 0.13, 0.13, 0.13, 0.13, 0.13, 0.13, 0.13, 0.13, 0.13, 0.13, 0.13]
  line "presence-service" [0.11, 0.11, 0.11, 0.11, 0.11, 0.11, 0.11, 0.11, 0.11, 0.11, 0.11, 0.11, 0.11, 0.11, 0.11, 0.11, 0.11, 0.11, 0.11, 0.11, 0.11, 0.11, 0.11, 0.11, 0.11, 0.11, 0.11, 0.11, 0.11, 0.11, 0.11]
  line "queue-worker-service" [0.13, 0.13, 0.13, 0.13, 0.13, 0.13, 0.13, 0.13, 0.13, 0.13, 0.13, 0.13, 0.13, 0.13, 0.13, 0.13, 0.13, 0.13, 0.13, 0.13, 0.13, 0.13, 0.13, 0.13, 0.13, 0.13, 0.13, 0.13, 0.13, 0.13, 0.13]
  line "rocketchat" [0.34, 0.34, 0.34, 0.34, 0.34, 0.34, 0.34, 0.34, 0.34, 0.34, 0.34, 0.34, 0.34, 0.34, 0.34, 0.34, 0.34, 0.34, 0.34, 0.34, 0.34, 0.34, 0.34, 0.34, 0.34, 0.34, 0.34, 0.34, 0.34, 0.34, 0.35]

Statistics (last 30 days):

📊 Average: 1.5GiB
⬇️ Minimum: 1.4GiB
⬆️ Maximum: 1.6GiB
🎯 Current PR: 1.1GiB

ℹ️ About this report

This report compares Docker image sizes from this build against the develop baseline.

Tag: pr-38730
Baseline: develop
Timestamp: 2026-02-17 15:11:59 UTC
Historical data points: 30

Updated: Tue, 17 Feb 2026 15:12:00 GMT

d-gubert · 2026-02-16T19:54:00Z

@copilot fix the following CI errors

https://github.com/RocketChat/Rocket.Chat/actions/runs/22071685141/job/63779382230?pr=38730
https://github.com/RocketChat/Rocket.Chat/actions/runs/22071685141/job/63779382216?pr=38730

Co-authored-by: d-gubert <1810309+d-gubert@users.noreply.github.com>

Copilot · 2026-02-16T19:58:19Z

@copilot fix the following CI errors

https://github.com/RocketChat/Rocket.Chat/actions/runs/22071685141/job/63779382230?pr=38730
...

Fixed the test failure in commit 2530b93. The test was using an incorrect pattern to access spy call arguments. I've updated it to properly capture the bridge call parameters using a simpler pattern that overrides the doCall method.

The failing tests were:

Unit Tests: ssrfValidationOption test - now fixed
TypeScript check - should pass now that the test file is corrected

CI should pass on the next run.

codecov · 2026-02-16T20:16:37Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 70.50%. Comparing base (18365fe) to head (2530b93).

Additional details and impacted files

@@                   Coverage Diff                   @@
##           change-checkforssrf   #38730      +/-   ##
=======================================================
- Coverage                70.50%   70.50%   -0.01%     
=======================================================
  Files                     3178     3176       -2     
  Lines                   111281   111226      -55     
  Branches                 20059    20099      +40     
=======================================================
- Hits                     78464    78415      -49     
+ Misses                   30771    30765       -6     
  Partials                  2046     2046

Flag	Coverage Δ
unit	`71.49% <ø> (-0.01%)`	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

Initial plan

b8d200d

Copilot AI assigned Copilot and d-gubert Feb 16, 2026

Copilot AI mentioned this pull request Feb 16, 2026

feat: rewrite checkUrlForSsrf and include it in the server-fetch package #38044

Open

Copilot started work on behalf of d-gubert February 16, 2026 17:03 View session

Copilot AI and others added 2 commits February 16, 2026 17:07

Add ssrfValidation option to HTTP accessor for opt-in SSRF protection

343a64c

Co-authored-by: d-gubert <1810309+d-gubert@users.noreply.github.com>

Improve explicitness of SSRF validation logic and fix documentation

851c916

Co-authored-by: d-gubert <1810309+d-gubert@users.noreply.github.com>

Copilot AI changed the title ~~[WIP] Update SSRF validation in checkUrlForSsrf implementation~~ Add opt-in SSRF validation to Apps-Engine HTTP accessor Feb 16, 2026

Copilot AI requested a review from d-gubert February 16, 2026 17:10

Copilot finished work on behalf of d-gubert February 16, 2026 17:10

rocketchat-github-ci added the Invalid PR Title label Feb 16, 2026

Copilot started work on behalf of d-gubert February 16, 2026 19:54 View session

Fix test: use proper pattern for capturing bridge calls

2530b93

Co-authored-by: d-gubert <1810309+d-gubert@users.noreply.github.com>

Copilot finished work on behalf of d-gubert February 16, 2026 19:59

refactor

41c9a03

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add opt-in SSRF validation to Apps-Engine HTTP accessor#38730

Add opt-in SSRF validation to Apps-Engine HTTP accessor#38730
Copilot wants to merge 5 commits intochange-checkforssrffrom
copilot/sub-pr-38044

Copilot AI commented Feb 16, 2026 •

edited

Loading

Uh oh!

changeset-bot bot commented Feb 16, 2026 •

edited

Loading

Uh oh!

dionisio-bot bot commented Feb 16, 2026 •

edited

Loading

Uh oh!

github-actions bot commented Feb 16, 2026 •

edited

Loading

Uh oh!

d-gubert commented Feb 16, 2026

Uh oh!

Copilot AI commented Feb 16, 2026

Uh oh!

codecov bot commented Feb 16, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

Copilot AI commented Feb 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

changeset-bot bot commented Feb 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

⚠️ No Changeset found

Uh oh!

dionisio-bot bot commented Feb 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Feb 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

📦 Docker Image Size Report

📈 Changes

📊 Historical Trend

Uh oh!

d-gubert commented Feb 16, 2026

Uh oh!

Copilot AI commented Feb 16, 2026

Uh oh!

codecov bot commented Feb 16, 2026

Codecov Report

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Copilot AI commented Feb 16, 2026 •

edited

Loading

changeset-bot bot commented Feb 16, 2026 •

edited

Loading

dionisio-bot bot commented Feb 16, 2026 •

edited

Loading

github-actions bot commented Feb 16, 2026 •

edited

Loading