Skip to content

fix: resolve SSRF and tainted format string code scanning alerts #27

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
Copilot wants to merge 3 commits into from
Closed

fix: resolve SSRF and tainted format string code scanning alerts #27

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
0214e9c
Initial plan
Copilot Mar 19, 2026
4727994
Initial plan for security fixes
Copilot Mar 19, 2026
8a9bbab
fix: resolve SSRF and tainted format string code scanning alerts
Copilot Mar 19, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
15 changes: 6 additions & 9 deletions calm-hub-ui/src/service/adr-service/adr-service.tsx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,9 +23,8 @@ export class AdrService {
})
.then((res) => res.data.values)
.catch((error) => {
const errorMessage = `Error fetching adr IDs for namespace ${namespace}:`;
console.error(errorMessage, error);
return Promise.reject(new Error(errorMessage));
console.error('Error fetching adr IDs for namespace:', namespace, error);
return Promise.reject(new Error('Error fetching adr IDs for namespace: ' + namespace));
});
}

Expand All @@ -40,9 +39,8 @@ export class AdrService {
})
.then((res) => res.data.values)
.catch((error) => {
const errorMessage = `Error fetching revisions for ADR ID ${adrID}:`;
console.error(errorMessage, error);
return Promise.reject(new Error(errorMessage));
console.error('Error fetching revisions for ADR ID:', adrID, error);
return Promise.reject(new Error('Error fetching revisions for ADR ID: ' + adrID));
});
}

Expand All @@ -57,9 +55,8 @@ export class AdrService {
})
.then((res) => res.data)
.catch((error) => {
const errorMessage = `Error fetching adr for namespace ${namespace}, adr ID ${adrID}, revision ${revision}:`;
console.error(errorMessage, error);
return Promise.reject(new Error(errorMessage));
console.error('Error fetching adr for namespace:', namespace, 'adr ID:', adrID, 'revision:', revision, error);
return Promise.reject(new Error('Error fetching adr for namespace: ' + namespace + ', adr ID: ' + adrID + ', revision: ' + revision));
});
}
}
27 changes: 9 additions & 18 deletions calm-hub-ui/src/service/calm-service.tsx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,7 +37,7 @@ export async function fetchPatternIDs(
const data = await res.json();
setPatternIDs(data.values.map((num: number) => num.toString()));
} catch (error) {
console.error(`Error fetching pattern IDs for namespace ${namespace}:`, error);
console.error('Error fetching pattern IDs for namespace:', namespace, error);
}
}

Expand All @@ -54,7 +54,7 @@ export async function fetchFlowIDs(namespace: string, setFlowIDs: (flowIDs: stri
const data = await res.json();
setFlowIDs(data.values.map((id: number) => id.toString()));
} catch (error) {
console.error(`Error fetching flow IDs for namespace ${namespace}:`, error);
console.error('Error fetching flow IDs for namespace:', namespace, error);
}
}

Expand All @@ -75,7 +75,7 @@ export async function fetchPatternVersions(
const data = await res.json();
setVersions(data.values);
} catch (error) {
console.error(`Error fetching versions for pattern ID ${patternID}:`, error);
console.error('Error fetching versions for pattern ID:', patternID, error);
}
}

Expand All @@ -96,7 +96,7 @@ export async function fetchFlowVersions(
const data = await res.json();
setFlowVersions(data.values);
} catch (error) {
console.error(`Error fetching versions for flow ID ${flowID}:`, error);
console.error('Error fetching versions for flow ID:', flowID, error);
}
}

Expand Down Expand Up @@ -128,10 +128,7 @@ export async function fetchPattern(
};
setPattern(data);
} catch (error) {
console.error(
`Error fetching pattern for namespace ${namespace}, pattern ID ${patternID}, version ${version}:`,
error
);
console.error('Error fetching pattern for namespace:', namespace, 'pattern ID:', patternID, 'version:', version, error);
}
}

Expand Down Expand Up @@ -163,10 +160,7 @@ export async function fetchFlow(
};
setFlow(data);
} catch (error) {
console.error(
`Error fetching flow for namespace ${namespace}, flow ID ${flowID}, version ${version}:`,
error
);
console.error('Error fetching flow for namespace:', namespace, 'flow ID:', flowID, 'version:', version, error);
}
}

Expand All @@ -186,7 +180,7 @@ export async function fetchArchitectureIDs(
const data = await res.json();
setArchitectureIDs(data.values.map((id: number) => id.toString()));
} catch (error) {
console.error(`Error fetching architecture IDs for namespace ${namespace}:`, error);
console.error('Error fetching architecture IDs for namespace:', namespace, error);
}
}

Expand All @@ -210,7 +204,7 @@ export async function fetchArchitectureVersions(
const data = await res.json();
setVersions(data.values);
} catch (error) {
console.error(`Error fetching versions for architecture ID ${architectureID}:`, error);
console.error('Error fetching versions for architecture ID:', architectureID, error);
}
}

Expand Down Expand Up @@ -242,9 +236,6 @@ export async function fetchArchitecture(
};
setArchitecture(data);
} catch (error) {
console.error(
`Error fetching architecture for namespace ${namespace}, architecture ID ${architectureID}, version ${version}:`,
error
);
console.error('Error fetching architecture for namespace:', namespace, 'architecture ID:', architectureID, 'version:', version, error);
}
}
20 changes: 0 additions & 20 deletions package-lock.json
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

24 changes: 24 additions & 0 deletions shared/src/document-loader/calmhub-document-loader.spec.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -47,4 +47,28 @@ describe('calmhub-document-loader', () => {
await expect(calmHubDocumentLoader.loadMissingDocument(traversalUrl, 'schema'))
.rejects.toThrow('directory traversal');
});

it('rejects percent-encoded directory traversal (%2e%2e)', async () => {
const traversalUrl = 'calm:/schemas/%2e%2e/admin/secrets.json';
await expect(calmHubDocumentLoader.loadMissingDocument(traversalUrl, 'schema'))
.rejects.toThrow('directory traversal');
});

it('rejects percent-encoded path separator (%2f)', async () => {
const traversalUrl = 'calm:/schemas%2f..%2fadmin/secrets.json';
await expect(calmHubDocumentLoader.loadMissingDocument(traversalUrl, 'schema'))
.rejects.toThrow('directory traversal');
});

it('rejects double-encoded traversal (%252e%252e)', async () => {
const traversalUrl = 'calm:/schemas/%252e%252e/admin/secrets.json';
await expect(calmHubDocumentLoader.loadMissingDocument(traversalUrl, 'schema'))
.rejects.toThrow('directory traversal');
});

it('rejects malformed percent-encoding in path', async () => {
const malformedUrl = 'calm:/schemas/%ZZ/invalid.json';
await expect(calmHubDocumentLoader.loadMissingDocument(malformedUrl, 'schema'))
.rejects.toThrow('invalid percent-encoding');
});
});
28 changes: 23 additions & 5 deletions shared/src/document-loader/calmhub-document-loader.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -52,16 +52,34 @@ export class CalmHubDocumentLoader implements DocumentLoader {
throw new Error(`CalmHubDocumentLoader only loads documents with protocol '${CALM_HUB_PROTO}'. (Requested: ${protocol})`);
}
// The URL constructor normalizes '..' segments, so url.pathname is already resolved.
// Reject if the original input contained traversal sequences before normalization.
if (documentId.includes('/..')) {
// Reject if the original input contained traversal sequences before normalization,
// including percent-encoded path separators (%2f, %5c), dot sequences (%2e), and
// double-encoded percent signs (%25) that could hide traversal after further decoding.
if (documentId.includes('/..') || /(%2e(%2e|\.)|\.%2e|%2f|%5c|%25)/i.test(documentId)) {
Comment on lines +57 to +58
throw new Error(`CalmHubDocumentLoader rejected path containing directory traversal in: ${documentId}`);
}
const path = url.pathname;
// Reconstruct a safe path by decoding each URL path segment individually, validating
// for traversal sequences and path separators, then re-encoding. This prevents SSRF
// via path injection while avoiding double-encoding of legitimate percent-escapes.
const segments = url.pathname.split('/').filter(s => s.length > 0);
const decodedSegments = segments.map(s => {
let decoded: string;
try {
decoded = decodeURIComponent(s);
} catch {
throw new Error(`CalmHubDocumentLoader rejected invalid percent-encoding in path: ${documentId}`);
}
if (decoded === '..' || decoded === '.' || decoded.includes('/') || decoded.includes('\\')) {
throw new Error(`CalmHubDocumentLoader rejected path containing directory traversal in: ${documentId}`);
}
return decoded;
});
const safePath = '/' + decodedSegments.map(s => encodeURIComponent(s)).join('/');

this.logger.debug(`Loading CALM schema from ${this.calmHubUrl}${path}`);
this.logger.debug(`Loading CALM schema from ${this.calmHubUrl}${safePath}`);

// TODO gracefully handle 404s and other errors
const response = await this.ax.get(path);
const response = await this.ax.get(safePath);
const document = response.data;
this.logger.debug('Successfully loaded document from CALMHub with id ' + documentId);
return document;
Expand Down
29 changes: 29 additions & 0 deletions shared/src/document-loader/direct-url-document-loader.spec.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -45,4 +45,33 @@ describe('direct-url-document-loader', () => {
await expect(directUrlDocumentLoader.loadMissingDocument(ftpUrl, 'schema'))
.rejects.toThrow('Only HTTP and HTTPS are allowed');
});

it.each([
'http://localhost/secret',
'http://localhost./secret',
'http://127.0.0.1/secret',
'http://10.0.0.1/secret',
'http://172.16.0.1/secret',
'http://192.168.1.1/secret',
'http://169.254.169.254/latest/meta-data/',
'http://0.0.0.0/secret',
'http://[::1]/secret',
'http://[0:0:0:0:0:0:0:1]/secret',
'http://[::]/secret',
'http://[::ffff:127.0.0.1]/secret',
'http://[::ffff:10.0.0.1]/secret',
'http://[::127.0.0.1]/secret',
'http://[::ffff:0:127.0.0.1]/secret',
'http://[fe80::1]/secret',
'http://[fe91::1]/secret',
'http://[febf::1]/secret',
'http://[fc00::1]/secret',
'http://[fd12::1]/secret',
'http://2130706433/secret',
'http://0x7f000001/secret',
'http://0177.0.0.1/secret',
])('rejects private/internal network URL: %s', async (url) => {
await expect(directUrlDocumentLoader.loadMissingDocument(url, 'schema'))
.rejects.toThrow('private or internal network');
});
});
Loading
Loading