fix: patch SSRF in Gemini proxy and payload injection in brochure APIs - #48
Draft
cursor[bot] wants to merge 2 commits into
Draft
fix: patch SSRF in Gemini proxy and payload injection in brochure APIs#48cursor[bot] wants to merge 2 commits into
cursor[bot] wants to merge 2 commits into
Conversation
The model route parameter was interpolated directly into the Vertex AI upstream URL without validation. URL-encoded path traversal characters (%2F, %3F) in the parameter could redirect authenticated requests to arbitrary paths on aiplatform.googleapis.com using the service account's ADC token. Add a regex allowlist (alphanumeric, hyphens, dots) and reject model names containing slashes, dots-dots, question marks, or other URL-special characters before constructing the upstream URL. Co-authored-by: CARBComplianceApp <CARBComplianceApp@users.noreply.github.com>
The /api/book, /api/intake, and /api/chat endpoints used object spread (`...data`) to merge user-submitted JSON into the fireAlert payload. This allowed attackers to override the `kind` and `site` fields and inject arbitrary keys that flow into KV storage, webhook payloads, and notification emails. Replace the open spread with explicit field destructuring so only expected form fields are forwarded. Rebuild all 11 generated sites. Co-authored-by: CARBComplianceApp <CARBComplianceApp@users.noreply.github.com>
Deploying with
|
| Status | Name | Latest Commit | Updated (UTC) |
|---|---|---|---|
| ❌ Deployment failed View logs |
dmc-properties | ea05522 | Jul 16 2026, 09:35 AM |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Security Fixes
Two vulnerabilities identified during automated security scan, both fixed in this PR:
1. SSRF via path traversal in Gemini provider (HIGH)
File:
the-unit/api/src/providers/gemini.tsThe
:modelroute parameter was interpolated directly into the Vertex AI upstream URL without validation. URL-encoded path traversal characters (%2F→/,%3F→?) in the parameter could redirect authenticated requests to arbitrary paths onaiplatform.googleapis.comusing the service account's ADC token.Fix: Added a regex allowlist (
/^[a-z0-9][-a-z0-9.]*$/i) that rejects model names containing slashes, dots-dots, question marks, or other URL-special characters before constructing the upstream URL.2. Webhook/email payload injection via object spread (MEDIUM)
File:
sites/build.mjs+ all 11 generatedsites/dist/*/worker.jsThe
/api/book,/api/intake, and/api/chatendpoints used{ kind: "booking", site: SITE_ID, ...data }to merge user JSON into thefireAlertpayload. This allowed attackers to overridekind/sitefields and inject arbitrary keys into KV storage, webhook payloads, and notification emails.Fix: Replaced open object spread with explicit field destructuring so only expected form fields are forwarded to downstream systems.
Verification
npm run typecheckpasses (gumption-api)npm run test:bootpasses (all 6 tests, including Gemini endpoint)node sites/build.mjsregenerates all 11 sites successfully