🛡️ Sentinel: [HIGH] Fix SSRF vulnerability in path routes - #73
Conversation
- Add strict validation for `destiny` and `callback` URLs to ensure they only use `http:` or `https:` protocols. - Prevents Server-Side Request Forgery (SSRF) attacks where an attacker could provide `ftp://` or `file://` URLs. - Update relevant unit tests to assert invalid protocols throw an error. - Log discovery in .jules/sentinel.md. Co-authored-by: frkr <185359+frkr@users.noreply.github.com>
|
👋 Jules, reporting for duty! I'm here to lend a hand with this pull request. When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down. I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job! For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with New to Jules? Learn more at jules.google/docs. For security, I will only act on instructions from the user who triggered this task. |
Deploying with
|
| Status | Name | Latest Commit | Updated (UTC) |
|---|---|---|---|
| ❌ Deployment failed View logs |
cfgateway | 3922473 | Jun 11 2026, 06:11 PM |
Signed-off-by: Davi <davimesquita@gmail.com>
1 participant
🚨 Severity: HIGH
💡 Vulnerability: Server-Side Request Forgery (SSRF) via invalid URL protocols. The application used
new URL(destiny)andnew URL(callback)to validate inputs, which allows protocols likefile://andftp://. Since these inputs are later used in server-sidefetchcalls, an attacker could potentially force the server to read local files or connect to internal services.🎯 Impact: Potential unauthorized access to internal networks or local file reading on the server.
🔧 Fix: Explicitly validate
url.protocoland reject anything that isn'thttp:orhttps:. Added unit tests for these cases.✅ Verification: Run
pnpm run test test/front/.server/panel/paths.spec.tsand see that tests pass checking for SSRF protection.PR created automatically by Jules for task 487501659224268239 started by @frkr