From 0b2dfa334865ed5da2f2f1a17d6cb7ccf421a7c8 Mon Sep 17 00:00:00 2001 From: anupamme Date: Fri, 18 Sep 2026 12:46:46 +0000 Subject: [PATCH] harden: add URL validation in index.ts The connections controller dynamically constructs URLs using fillUrlWithPathAndQueryParams() with user-controlled pathParams and queryParams, then passes the result to fetch() without validating the final URL Addresses CWE-918 --- src/vault/controller/connections/index.ts | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/src/vault/controller/connections/index.ts b/src/vault/controller/connections/index.ts index 0c3025f..e77e208 100644 --- a/src/vault/controller/connections/index.ts +++ b/src/vault/controller/connections/index.ts @@ -204,6 +204,12 @@ class ConnectionController { invokeRequest.pathParams, invokeRequest.queryParams, ); + // Ensure that substituting user-controlled pathParams/queryParams did not + // change the request's destination (host/origin), preventing SSRF via + // injected values such as "@evil.com" or "../" in a path param. + if (new URL(filledUrl).origin !== new URL(this.client.url).origin) { + throw new Error("Invalid connection URL: destination origin mismatch"); + } getBearerToken(this.client.getCredentials(), this.logLevel) .then((token) => { printLog(