Skip to content

fix(security): trusted internal origin for provider auto-sync self-fetch (CodeQL #323 SSRF) #3336

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
diegosouzapw merged 1 commit into from
Jun 7, 2026
Merged

fix(security): trusted internal origin for provider auto-sync self-fetch (CodeQL #323 SSRF) #3336

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 10 additions & 2 deletions src/app/api/providers/route.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -32,7 +32,10 @@ import {
import { requireManagementAuth } from "@/lib/api/requireManagementAuth";
import { isManagedProviderConnectionId } from "@/lib/providers/catalog";
import { isApiKeyRevealEnabled, maskStoredApiKey } from "@/lib/apiKeyExposure";
import { buildModelSyncInternalHeaders } from "@/shared/services/modelSyncScheduler";
import {
buildModelSyncInternalHeaders,
getModelSyncInternalBaseUrl,
} from "@/shared/services/modelSyncScheduler";

// GET /api/providers - List all connections
export async function GET(request: Request) {
Expand Down Expand Up @@ -174,7 +177,12 @@ export async function POST(request: Request) {
// auth header (defense in depth) and an X-Internal-Auto-Sync marker for
// log correlation.
try {
const internalOrigin = new URL(request.url).origin;
// SECURITY: use the trusted loopback/env-pinned origin, NOT
// `new URL(request.url).origin` — the latter comes from the client-
// controlled Host header, which would let a caller redirect this
// credential-bearing internal self-fetch to an arbitrary host
// (SSRF + internal-auth-header exfiltration; CodeQL js/request-forgery).
const internalOrigin = getModelSyncInternalBaseUrl();
const cookieHeader = request.headers.get("cookie") || "";
const syncHeaders: Record<string, string> = {
"Content-Type": "application/json",
Expand Down
13 changes: 13 additions & 0 deletions src/shared/services/modelSyncScheduler.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,6 +24,19 @@ const INTERNAL_BASE_URL =
process.env.NEXT_PUBLIC_APP_URL ||
`http://127.0.0.1:${dashboardPort}`;

/**
* Trusted origin for server-internal self-fetches (model sync, auto-discovery).
*
* SECURITY: never derive this from the incoming request (`request.url` /
* `Host` header) — that is client-controlled and lets a caller redirect an
* internal, credential-bearing self-fetch to an arbitrary host (SSRF +
* internal-auth-header exfiltration; CodeQL js/request-forgery). Always use
* this loopback/env-pinned origin instead.
*/
export function getModelSyncInternalBaseUrl(): string {
return INTERNAL_BASE_URL;
}
Comment on lines +36 to +38

@gemini-code-assist gemini-code-assist Bot Jun 7, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

If INTERNAL_BASE_URL (configured via environment variables like BASE_URL or NEXT_PUBLIC_APP_URL) contains a trailing slash, appending /api/providers/... will result in a double slash (e.g., https://example.com//api/providers/...). This can cause routing or redirection issues in Next.js, potentially dropping authentication headers. Normalizing the URL by stripping any trailing slash ensures robust request routing.

Suggested change
export function getModelSyncInternalBaseUrl(): string {
return INTERNAL_BASE_URL;
}
export function getModelSyncInternalBaseUrl(): string {
return INTERNAL_BASE_URL.replace(/\/$/, "");
}


const globalState = globalThis as typeof globalThis & {
__omnirouteModelSyncInternalAuthToken?: string;
};
Expand Down
35 changes: 35 additions & 0 deletions tests/unit/providers-autosync-ssrf-323.test.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,35 @@
/**
* Regression guard — CodeQL js/request-forgery alert #323 (v3.8.13).
*
* POST /api/providers fires a non-blocking self-fetch to the connection's
* /sync-models route, forwarding the management cookie + internal sync auth
* headers. #3267 built that self-fetch origin from `new URL(request.url).origin`
* — i.e. the client-controlled Host header — so a caller could redirect the
* credential-bearing internal request to an arbitrary host (SSRF + internal
* auth-header exfiltration).
*
* The origin must come from the trusted loopback/env-pinned base URL
* (`getModelSyncInternalBaseUrl()`), never from the incoming request.
*/

import test from "node:test";
import assert from "node:assert/strict";
import { readFileSync } from "node:fs";
import { join } from "node:path";

const routeSrc = readFileSync(
join(import.meta.dirname, "../../src/app/api/providers/route.ts"),
"utf8"
);
Comment on lines +17 to +23

@gemini-code-assist gemini-code-assist Bot Jun 7, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

import.meta.dirname is only supported in Node.js v20.11.0+ and v21.2.0+. If the project or CI environment runs on an older Node.js version (such as Node 18 or older Node 20 releases), this will throw a TypeError and break the test suite. Using fileURLToPath(import.meta.url) with dirname is a more compatible approach for ESM in Node.js.

import { readFileSync } from "node:fs";
import { join, dirname } from "node:path";
import { fileURLToPath } from "node:url";

const __dirname = dirname(fileURLToPath(import.meta.url));
const routeSrc = readFileSync(
  join(__dirname, "../../src/app/api/providers/route.ts"),
  "utf8"
);


test("POST /api/providers auto-sync uses the trusted internal origin (not request.url) — #323", () => {
assert.ok(
routeSrc.includes("getModelSyncInternalBaseUrl()"),
"auto-sync self-fetch must derive its origin from getModelSyncInternalBaseUrl()"
);
assert.doesNotMatch(
routeSrc,
/const\s+internalOrigin\s*=\s*new URL\(request\.url\)\.origin/,
"auto-sync origin must NOT be derived from the client-controlled request.url/Host (SSRF, CodeQL js/request-forgery #323)"
);
});