🛡️ Sentinel: [HIGH] Fix Command Injection/SSRF via URL Handler#228
🛡️ Sentinel: [HIGH] Fix Command Injection/SSRF via URL Handler#228
Conversation
The OS-specific URL handlers (e.g., `exec.Command("open", url)`) lacked
validation of the URL scheme. An attacker could potentially supply
malicious schemes like `file://` to read local files or trigger command
injection if the input was fully attacker-controlled.
This commit adds safe URL scheme validation using `net/url.Parse()`,
strictly limiting allowed schemes to `http` and `https`. The parameter
`url` was renamed to `rawurl` to avoid shadowing the standard library
package. Unit tests were added to explicitly verify that invalid
schemes are rejected.
Co-authored-by: rschumann <360788+rschumann@users.noreply.github.com>
|
👋 Jules, reporting for duty! I'm here to lend a hand with this pull request. When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down. I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job! For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with New to Jules? Learn more at jules.google/docs. For security, I will only act on instructions from the user who triggered this task. |
1 participant
🚨 Severity: HIGH
💡 Vulnerability: The OS-specific URL handlers (e.g.,
exec.Command("open", url)) lacked validation of the URL scheme. An attacker could potentially supply malicious schemes likefile://to read local files or trigger command injection if the input was fully attacker-controlled.🎯 Impact: Potential Command Injection and Server-Side Request Forgery (SSRF) resulting in unauthorized file access or arbitrary command execution on the host system.
🔧 Fix: Added safe URL scheme validation using
net/url.Parse(), strictly limiting allowed schemes tohttpandhttps. Parameterurlrenamed torawurlto avoid shadowing the standard library package.✅ Verification: Run
go test ./internal/browser/... -short. Verified negative cases such asfile://orjavascript:correctly fail without triggering the command execution.PR created automatically by Jules for task 9052784989756378211 started by @rschumann