Repository navigation
fix(security): cherry-pick 3 SSRF guards (loopback via proxy, DNS rebinding, Kiro region) - #4972
Closed
KooshaPari wants to merge 4 commits into
Closed
KooshaPari wants to merge 4 commits into
KooshaPari wants to merge 4 commits into
Conversation
…ng (GHSA-cmhj-wh2f-9cgx) (cheaper-inference#4634) Integrated into release/v3.8.36 — pin DNS for image fetch SSRF rebinding guard (GHSA-cmhj-wh2f-9cgx, port c7d07448); caller DNS stubs + test-file baseline reconciled; release-green (cherry picked from commit 9244d93)
…se proxy (cheaper-inference#4632) Integrated into release/v3.8.36 — port rebuilt clean, release-green (cherry picked from commit 486f017)
) (cheaper-inference#4629) Integrated into release/v3.8.36 — kiro region SSRF guard (GHSA-6mwv-4mrm-5p3m), port rebuilt clean over release tip (cherry picked from commit 983e152)
Contributor
|
Warning You have reached your daily quota limit. Please wait up to 24 hours and I will start processing your requests again! |
… for KP fork Upstream commit 971a046 fixes an SSRF in the Codex imageHelper path (open-sse/translator/helpers/imageHelper.ts). In KooshaPari/OmniRoute, that file was deleted on 2026-05-06 (commit 0592444, 'chore(OmniRoute): add packageManager field') as part of the v8.1 Bifrost Tier-1 router refactor (ADR-031) which superseded the codex imageHelper path entirely. The vulnerable SSRF code no longer exists in this fork, so the upstream fix is a no-op. The associated regression test (tests/unit/imageHelper-ssrf.test.ts) is also dropped because it imports the deleted helper module and would not compile. This commit records the resolution for the security-audit trail (ADR-042 monthly cadence). Refs: - upstream: 971a046 (diegosouzapw/OmniRoute, 2026-06) - KP deletion: 0592444 (KooshaPari/OmniRoute, 2026-05-06) - ADR-031: docs/adr/0031-bifrost-tier1-router.md - ADR-042: docs/adr/0042-security-audit-cadence.md
Contributor
Author
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Cherry-picks 3 CVE-class SSRF security fixes from upstream
diegosouzapw/OmniRoutev3.8.31 -> v3.8.35, with no API change and no KP-coupling.Files (16 changed, +645 / -20)
The 3 cherry-picks:
679c124 —
fix(security): don't trust loopback socket as local when behind reverse proxy (#4632)— route-guard was treating loopback as 'local' and skipping the auth check; behind a reverse proxy this means any request forwarded from the proxy's loopback gets treated as trusted. Adds 112-line test + loopback-with-proxy detection.1569cc4 —
fix(security): pin image fetch DNS resolution to prevent SSRF rebinding (GHSA-cmhj-wh2f-9cgx) (#4634)— image fetcher did DNS once, then reconnected to a possibly-different IP. Pins DNS resolution for the connection lifetime. Adds 121-line test for the rebinding scenario + fixes a nanobanana test.1fdb299 —
fix(security): validate kiro region to prevent SSRF (GHSA-6mwv-4mrm-5p3m) (#4629)— Kiro provider accepted arbitrary region strings; validates against an allowlist before passing to upstream.The 4th cherry-pick (skipped)
971a046 —
fix(security): SSRF guard for Codex imageHelper.ts— this is a no-op for KP becauseopen-sse/translator/helpers/imageHelper.tswas deleted by the v8.1 Bifrost Tier-1 refactor (commit 0592444, 2026-05-06). The vulnerable code path no longer exists in this fork. The associated regression test (tests/unit/codex-image-helper-ssrf-guard.test.ts) imports the deleted module and would not compile, so it's also dropped. Recorded as no-op in the security-audit trail.Why this matters
Compatibility
Test plan
pnpm vitest run tests/unit/route-guard-loopback-via-proxy.test.tspnpm vitest run tests/unit/remote-image-fetch-dns-rebinding.test.tspnpm vitest run tests/unit/nanobanana-image-handler.test.tspnpm tsc --noEmitpnpm dev+ try to fetch an image from a domain that DNS-resolves to a private IP — should be blockedRefs