Repository navigation
fix(security): match virtual auto/* and qtSd/* routes against a key's combo allow-list (GHSA-7j4q-6gx6-pg77) - #15072
Merged
Conversation
… combo allow-list (GHSA-7j4q-6gx6-pg77) isComboAllowedForKey() resolved the requested model to a persisted combo row. Built-in virtual routes (auto/*, qtSd/*) dispatch like combos but are not persisted, so the lookup returned null — read as "not a combo, allowed". A key restricted to allowedCombos: ["my-combo"] could therefore reach every connected provider through auto/coding, auto/fast, auto/cheap, including paid OAuth subscription accounts. Virtual routes now fall back to their own name as the combo name, so they are denied unless the key's allow-list grants them (the combo/* wildcard or an explicit entry). Unrestricted keys are unaffected and allowAutoCombos (#13670) still applies on top. The model-restriction branch reuses the same helper. Test fails on the old code (auto/coding allowed for a restricted key). Co-authored-by: Aldo <17973757+aldoeliacim@users.noreply.github.com>
Collaborator
Author
|
Validation on 192.168.0.113 (2434554): |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes GHSA-7j4q-6gx6-pg77. Reported, reproduced and fixed by @aldoeliacim; this PR lands the patch and regression test from the advisory, with credit.
Problem
isComboAllowedForKey()resolves the requested model to a persisted combo row. The built-in virtual routesauto/*andqtSd/*dispatch like combos, but they are not persisted, so the lookup returnednull. That was read as "not a combo, allowed".As a result, a key restricted to
allowedCombos: ["my-combo"]could still reach every connected provider throughauto/coding,auto/fastandauto/cheap, including paid OAuth subscription accounts. The route was also reachable through/v1/messages. #13670'sallowAutoCombosis an opt-out that defaults to allowed, so it did not close this.Fix (fail closed)
When no persisted combo matches, a virtual route falls back to its own name as the combo name. It is then denied unless the key's allow-list grants it, either through the
combo/*wildcard or an explicit entry. Unrestricted and wildcard keys are unaffected, andallowAutoCombos: falsestill applies on top. The model-restriction branch reuses the sameisVirtualComboModel()helper.Validation
restricted combo keys cannot dispatch virtual auto routes:auto/coding|fast|cheapis denied for a named-combo key, a deny-all key and an opted-out key;combo/*key;auto/codingallowed).api-key-policypasses all 44 tests. The API-key and combo-access suites run on 192.168.0.113; results are in a comment below.