Security: Potential SSRF via URL input in Request.download() - #1790

TypeError: Cannot destructure property 'specSourceUrl' of 'policy' as it is undefined. ❯ isRemoteSchemaFetchAllowed src/util/remote-schema-fetch.ts:149:11 ❯ Request.download src/util/request.ts:22:10 ❯ SwaggerSchemaResolver.fetchSwaggerSchemaFile src/swagger-schema-resolver.ts:131:31 ❯ SwaggerSchemaResolver.create src/swagger-schema-resolver.ts:37:44 ❯ CodeGenProcess.start src/code-gen-process.ts:94:68 ❯ generateApi src/index.ts:13:31 ❯ tests/resolved-swagger-schema-ssrf.test.ts:152:11 This error originated in "tests/resolved-swagger-schema-ssrf.test.ts" test file. It doesn't mean the error was thrown inside the file itself, but while it was running. The latest test that might've caused the error is "does not follow redirects to cross-origin loopback targets". It might mean one of the following: - The error was thrown, while Vitest was running this test. - If the error occurred after the test had been completed, this was the last documented test before it was thrown.

TypeError: Cannot destructure property 'specSourceUrl' of 'policy' as it is undefined. ❯ isRemoteSchemaFetchAllowed src/util/remote-schema-fetch.ts:149:11 ❯ Request.download src/util/request.ts:22:10 ❯ SwaggerSchemaResolver.fetchSwaggerSchemaFile src/swagger-schema-resolver.ts:131:31 ❯ SwaggerSchemaResolver.create src/swagger-schema-resolver.ts:37:44 ❯ CodeGenProcess.start src/code-gen-process.ts:94:68 ❯ generateApi src/index.ts:13:31 ❯ tests/resolved-swagger-schema-ssrf.test.ts:136:11 This error originated in "tests/resolved-swagger-schema-ssrf.test.ts" test file. It doesn't mean the error was thrown inside the file itself, but while it was running. The latest test that might've caused the error is "does not contact internal server when spec has no external $ref". It might mean one of the following: - The error was thrown, while Vitest was running this test. - If the error occurred after the test had been completed, this was the last documented test before it was thrown.

TypeError: Cannot destructure property 'specSourceUrl' of 'policy' as it is undefined. ❯ isRemoteSchemaFetchAllowed src/util/remote-schema-fetch.ts:149:11 ❯ Request.download src/util/request.ts:22:10 ❯ SwaggerSchemaResolver.fetchSwaggerSchemaFile src/swagger-schema-resolver.ts:131:31 ❯ SwaggerSchemaResolver.create src/swagger-schema-resolver.ts:37:44 ❯ CodeGenProcess.start src/code-gen-process.ts:94:68 ❯ generateApi src/index.ts:13:31 ❯ tests/spec/paths-2/basic.test.ts:88:11 This error originated in "tests/spec/paths-2/basic.test.ts" test file. It doesn't mean the error was thrown inside the file itself, but while it was running. The latest test that might've caused the error is "generates data contracts and http client from remote openapi url". It might mean one of the following: - The error was thrown, while Vitest was running this test. - If the error occurred after the test had been completed, this was the last documented test before it was thrown.

TypeError: Cannot destructure property 'specSourceUrl' of 'policy' as it is undefined. ❯ isRemoteSchemaFetchAllowed src/util/remote-schema-fetch.ts:149:11 ❯ Request.download src/util/request.ts:22:10 ❯ SwaggerSchemaResolver.fetchSwaggerSchemaFile src/swagger-schema-resolver.ts:131:31 ❯ SwaggerSchemaResolver.create src/swagger-schema-resolver.ts:37:44 ❯ CodeGenProcess.start src/code-gen-process.ts:94:68 ❯ generateApi src/index.ts:13:31 ❯ tests/yaml-url-input.test.ts:171:11 This error originated in "tests/yaml-url-input.test.ts" test file. It doesn't mean the error was thrown inside the file itself, but while it was running. The latest test that might've caused the error is "generates API from YAML URL via 'input' parameter (falls back to url)". It might mean one of the following: - The error was thrown, while Vitest was running this test. - If the error occurred after the test had been completed, this was the last documented test before it was thrown.

TypeError: Cannot destructure property 'specSourceUrl' of 'policy' as it is undefined. ❯ isRemoteSchemaFetchAllowed src/util/remote-schema-fetch.ts:149:11 ❯ Request.download src/util/request.ts:22:10 ❯ SwaggerSchemaResolver.fetchSwaggerSchemaFile src/swagger-schema-resolver.ts:131:31 ❯ SwaggerSchemaResolver.create src/swagger-schema-resolver.ts:37:44 ❯ CodeGenProcess.start src/code-gen-process.ts:94:68 ❯ generateApi src/index.ts:13:31 ❯ tests/resolved-swagger-schema-ssrf.test.ts:120:11 This error originated in "tests/resolved-swagger-schema-ssrf.test.ts" test file. It doesn't mean the error was thrown inside the file itself, but while it was running. The latest test that might've caused the error is "does not fetch cross-origin loopback $ref targets". It might mean one of the following: - The error was thrown, while Vitest was running this test. - If the error occurred after the test had been completed, this was the last documented test before it was thrown.

TypeError: Cannot destructure property 'specSourceUrl' of 'policy' as it is undefined. ❯ isRemoteSchemaFetchAllowed src/util/remote-schema-fetch.ts:149:11 ❯ Request.download src/util/request.ts:22:10 ❯ SwaggerSchemaResolver.fetchSwaggerSchemaFile src/swagger-schema-resolver.ts:131:31 ❯ SwaggerSchemaResolver.create src/swagger-schema-resolver.ts:37:44 ❯ CodeGenProcess.start src/code-gen-process.ts:94:68 ❯ generateApi src/index.ts:13:31 ❯ tests/yaml-url-input.test.ts:149:11 This error originated in "tests/yaml-url-input.test.ts" test file. It doesn't mean the error was thrown inside the file itself, but while it was running. The latest test that might've caused the error is "generates API from YAML URL via 'url' parameter". It might mean one of the following: - The error was thrown, while Vitest was running this test. - If the error occurred after the test had been completed, this was the last documented test before it was thrown.

TypeError: Cannot destructure property 'specSourceUrl' of 'policy' as it is undefined. ❯ isRemoteSchemaFetchAllowed src/util/remote-schema-fetch.ts:149:11 ❯ Request.download src/util/request.ts:22:10 ❯ SwaggerSchemaResolver.fetchSwaggerSchemaFile src/swagger-schema-resolver.ts:131:31 ❯ SwaggerSchemaResolver.create src/swagger-schema-resolver.ts:37:44 ❯ tests/swagger-schema-resolver.test.ts:148:39 This error originated in "tests/swagger-schema-resolver.test.ts" test file. It doesn't mean the error was thrown inside the file itself, but while it was running. The latest test that might've caused the error is "loads root schema by url and resolves relative external refs". It might mean one of the following: - The error was thrown, while Vitest was running this test. - If the error occurred after the test had been completed, this was the last documented test before it was thrown.

TypeError: Cannot destructure property 'specSourceUrl' of 'policy' as it is undefined. ❯ isRemoteSchemaFetchAllowed src/util/remote-schema-fetch.ts:149:11 ❯ Request.download src/util/request.ts:22:10 ❯ SwaggerSchemaResolver.fetchSwaggerSchemaFile src/swagger-schema-resolver.ts:131:31 ❯ SwaggerSchemaResolver.create src/swagger-schema-resolver.ts:37:44 ❯ CodeGenProcess.start src/code-gen-process.ts:94:68 ❯ generateApi src/index.ts:13:31 ❯ tests/resolved-swagger-schema-auth.test.ts:207:11 This error originated in "tests/resolved-swagger-schema-auth.test.ts" test file. It doesn't mean the error was thrown inside the file itself, but while it was running. The latest test that might've caused the error is "does not contact attacker server when spec has no cross-origin $ref". It might mean one of the following: - The error was thrown, while Vitest was running this test. - If the error occurred after the test had been completed, this was the last documented test before it was thrown.

TypeError: Cannot destructure property 'specSourceUrl' of 'policy' as it is undefined. ❯ isRemoteSchemaFetchAllowed src/util/remote-schema-fetch.ts:149:11 ❯ Request.download src/util/request.ts:22:10 ❯ SwaggerSchemaResolver.fetchSwaggerSchemaFile src/swagger-schema-resolver.ts:131:31 ❯ SwaggerSchemaResolver.create src/swagger-schema-resolver.ts:37:44 ❯ CodeGenProcess.start src/code-gen-process.ts:94:68 ❯ generateApi src/index.ts:13:31 ❯ tests/resolved-swagger-schema-auth.test.ts:185:11 This error originated in "tests/resolved-swagger-schema-auth.test.ts" test file. It doesn't mean the error was thrown inside the file itself, but while it was running. The latest test that might've caused the error is "forwards authorizationToken to same-origin $ref URLs". It might mean one of the following: - The error was thrown, while Vitest was running this test. - If the error occurred after the test had been completed, this was the last documented test before it was thrown.