From d10751a328a2c571bf950300ede9bd8add3acadf Mon Sep 17 00:00:00 2001 From: tomaioo Date: Thu, 18 Jun 2026 17:24:05 -0700 Subject: [PATCH] fix(util): potential ssrf via url input in request.download() The `Request.download()` method in `src/util/request.ts` accepts a `url` parameter and passes it directly to `fetch()` without validation. While there is some IP filtering in `remote-schema-fetch.ts`, the `Request.download()` method itself does not perform any validation. If called directly with user-controlled input, this could lead to Server-Side Request Forgery (SSRF), allowing attackers to make requests to internal services or cloud metadata endpoints. Signed-off-by: tomaioo <203048277+tomaioo@users.noreply.github.com> --- src/util/request.ts | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/src/util/request.ts b/src/util/request.ts index f0de374c0..d29ba4451 100644 --- a/src/util/request.ts +++ b/src/util/request.ts @@ -1,6 +1,7 @@ import { consola } from "consola"; import { merge } from "es-toolkit"; import type { CodeGenConfig } from "../configuration.js"; +import { isRemoteSchemaFetchAllowed } from "./remote-schema-fetch.js"; export class Request { config: CodeGenConfig; @@ -18,6 +19,12 @@ export class Request { authToken?: string; options?: Partial; }) { + if (!isRemoteSchemaFetchAllowed(url)) { + const message = `URL "${url}" is not allowed for fetching`; + consola.error(message); + return message; + } + const requestOptions: Partial = {}; if (authToken) {