Repository navigation
fix(shared): block cloud-metadata hosts under default remote-image guard - #11755
Merged
diegosouzapw merged 1 commit intoAug 30, 2026
Conversation
validateRemoteImageUrl() only special-cased "public-only", so the default "block-metadata" guard mode (getProviderOutboundGuard()'s local-first default) fell through to the unchecked parseOutboundUrl(), letting remote-image/media fetches reach cloud-metadata and link-local endpoints (SSRF -> IAM-credential pivot). Route "block-metadata" through parseAndValidateNonMetadataUrl(), matching the other three call sites of that guard mode. Add coverage for the default guard mode: every existing test passed guard: "public-only" explicitly, which is why this branch went untested.
diegosouzapw
merged commit Aug 30, 2026
faebf6d
into
cheaper-inference:release/v3.8.51
3 checks passed
muhamadgalihsaputra
pushed a commit
to niyatna/NiyatnaRoute
that referenced
this pull request
Sep 27, 2026
…ard (cheaper-inference#11755) Boarded in a combined worktree: typecheck:core, check:dashboard-typecheck, check:file-size, check:changelog-integrity, check:complexity, check:cognitive-complexity, check:cycles, check-deps all green; 10/10 focused tests pass. Real SSRF gap confirmed — the default "block-metadata" guard mode fell through to the unchecked parseOutboundUrl() while 3 other call sites of the same guard mode already routed through parseAndValidateNonMetadataUrl(). Good catch that the existing test suite only ever exercised "public-only" explicitly. Retargeted from the stale release/v3.8.50 base to release/v3.8.51. Thanks for closing a real cloud-metadata SSRF exposure.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
validateRemoteImageUrl()insrc/shared/network/remoteImageFetch.tsonly special-cased the"public-only"guard mode; the default"block-metadata"mode (getProviderOutboundGuard()'s local-first default) fell through to the uncheckedparseOutboundUrl(), so remote-image/media fetches could reach cloud-metadata and link-local endpoints (SSRF → IAM-credential pivot) even though 3 other call sites of this guard mode already route it throughparseAndValidateNonMetadataUrl()."block-metadata"branch, matching the existing pattern insafeOutboundFetch.ts.remote-image-fetch.test.tspassedguard: "public-only"explicitly, which is exactly why this branch went untested.Test plan
node --import tsx/esm --test tests/unit/remote-image-fetch.test.ts tests/unit/remote-media-fetch.test.ts— 10/10 passnpx eslint src/shared/network/remoteImageFetch.ts tests/unit/remote-image-fetch.test.ts— clean