endpoints to receive/forward hq invites #51
Conversation
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| user_token = request.data["user_token"] | ||
| invite_code = unquote_plus(callback_url) | ||
| try: | ||
| response = requests.post(callback_url, data={"invite_code": invite_code, "token": user_token}) |
Check failure
Code scanning / CodeQL
Full server-side request forgery Critical
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix AI 4 days ago
To fix the SSRF vulnerability, we need to validate the callback_url to ensure it points to a trusted domain. One way to do this is to maintain a list of allowed domains and check if the callback_url belongs to one of these domains before making the request. This approach ensures that only URLs from trusted domains are used.
- Create a list of allowed domains.
- Parse the
callback_urland extract the domain. - Check if the extracted domain is in the list of allowed domains.
- If the domain is not allowed, return an error response.
- If the domain is allowed, proceed with the request.
| @@ -3,3 +3,3 @@ | ||
| from secrets import token_hex | ||
| from urllib.parse import quote_plus, unquote_plus | ||
| from urllib.parse import quote_plus, unquote_plus, urlparse | ||
|
|
||
| @@ -459,2 +459,9 @@ | ||
| invite_code = unquote_plus(callback_url) | ||
|
|
||
| # Validate the callback_url | ||
| allowed_domains = ["trusteddomain.com", "anothertrusteddomain.com"] | ||
| parsed_url = urlparse(unquote_plus(callback_url)) | ||
| if parsed_url.netloc not in allowed_domains: | ||
| return JsonResponse({"error": "Invalid callback URL"}, status=400) | ||
|
|
||
| try: |
| authentication_classes = [ClientProtectedResourceAuth] | ||
|
|
||
| def post(self, request, *args, **kwargs): | ||
| callback_url = quote_plus(request.data["callback_url"]) |
There was a problem hiding this comment.
where does callback_url come from and point to?
|
|
||
|
|
||
| class ConfirmHQInviteCallback(APIView): | ||
| authentication_classes = [ClientProtectedResourceAuth] |
There was a problem hiding this comment.
Who makes this call? Is this not from mobile?
Spec
Ticket