diff options
| author | Fuwn <[email protected]> | 2026-06-01 15:37:21 +0000 |
|---|---|---|
| committer | Fuwn <[email protected]> | 2026-06-01 15:37:21 +0000 |
| commit | 662631a27948d431e6bd37fed15077b1bcccc7f8 (patch) | |
| tree | b71ddebe246ffb51fb214664233f6a38a26a6211 /src/routes/api/myanimelist/oauth/callback | |
| parent | fix(security): authorize shadowHide target in badges endpoint (IDOR) (diff) | |
| download | due.moe-662631a27948d431e6bd37fed15077b1bcccc7f8.tar.xz due.moe-662631a27948d431e6bd37fed15077b1bcccc7f8.zip | |
fix(security): allow-list web-push endpoints to stop SSRF
Stored push subscriptions carry a client-supplied `endpoint`, and the
notifications job POSTed to it with no host check, so a subscription
with an internal/metadata URL turned the Trigger.dev worker into a blind
SSRF primitive. Add isAllowedPushEndpoint (https + known vendor hosts:
FCM, Mozilla, Apple, WNS), skip non-conforming endpoints in the job, and
reject them at subscribe time. Browser-minted subscriptions always match
a vendor host, so real delivery is unchanged; a behaviour-gate test
asserts vendor endpoints pass and internal/non-https/look-alikes fail.
Diffstat (limited to 'src/routes/api/myanimelist/oauth/callback')
0 files changed, 0 insertions, 0 deletions