Refactor

[kshmidt-digma]

No description provided.

To fix the problem, the rejectUnauthorized: false option should be removed or set to true (the default). This will ensure that HTTPS requests made by the Axios client will validate server certificates, protecting against man-in-the-middle attacks. The best way to fix this is to remove the httpsAgent option entirely if there is no need for custom agent configuration, or to set rejectUnauthorized: true if a custom agent is still required for other reasons. The change should be made in the constructor of DigmaApiClient, specifically on lines 27–29 of src/api/DigmaApiClient.ts.

---

To fix this SSRF vulnerability, we should validate and sanitize the incidentId parameter before using it to construct the outgoing request URL. The best approach is to enforce a strict allow-list of acceptable formats for incidentId. If incidentId is expected to be a UUID, we should check that it matches a UUID regex. If it is a numeric ID, we should check that it is a number. This validation should be performed as close as possible to the entry point of the tainted data, ideally in attachIncidentFileToChatContext in src/uris/handlers/context.ts, before passing the value to the API client. If the value does not match the expected format, we should throw an error or reject the request.

Required changes:

• In src/uris/handlers/context.ts, add validation for incidentId at the start of attachIncidentFileToChatContext.
• If the value is invalid, throw an error.
• No new imports are needed if we use a simple regex.

---

To fix the problem, we need to ensure that the incidentId value cannot be used to perform path traversal or inject special characters into the filename. The best way to do this is to sanitize the incidentId before using it in the filename. We can use the well-known sanitize-filename npm package to remove any potentially dangerous characters from the incidentId. This will ensure that the resulting filename is safe and cannot be used to escape the intended directory. The changes should be made in src/uris/handlers/context.ts, specifically where the filename is constructed. We will need to import sanitize-filename and apply it to incidentId before using it in the filename.