chore: Potential fix for code scanning alert no. 34: Server-side request forgery #393
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
…est forgery Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
DerekRoberts
changed the title
Contributor
There was a problem hiding this comment.
Pull request overview
This PR addresses a code scanning alert for Server-Side Request Forgery (SSRF) vulnerability in the Maven Wrapper downloader by implementing URL validation with an allowlist of trusted Maven repository hosts. The fix prevents arbitrary URLs from being used for downloads by validating both the protocol (HTTPS only) and the host (restricted to known Maven repositories) before initiating any download operations.
Key Changes:
- Added SSRF protection through URL validation in MavenWrapperDownloader
- Implemented allowlist validation for Maven repository hosts (repo.maven.apache.org and repo1.maven.org)
- Enforced HTTPS-only protocol with early exit on validation failure
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
4 tasks
Contributor
|
@DerekRoberts I've opened a new pull request, #397, to work on those changes. Once the pull request is ready, I'll request review from you. |
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: DerekRoberts <4391600+DerekRoberts@users.noreply.github.com>
Combines security fixes from both PRs: - SSRF protection: URL validation with allowlist (from alert-autofix-34) - Path traversal protection: baseDir validation and symlink resolution (from main)
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Potential fix for https://github.com/bcgov/quickstart-openshift-backends/security/code-scanning/34
To fix the SSRF risk, we must prevent arbitrary URLs from being used for downloads. The best approach is to restrict the allowable URLs to an authorized list or ensure they match a safe prefix (e.g., only allow downloads from “https://repo.maven.apache.org/maven2/” or another expected Maven repository domain). Practically, in this code, we should validate
wrapperUrlafter parsing and before initiating any download: either by checking the domain and scheme are expected values or matching the URL against a whitelist of allowed URLs. Editing is required primarily in the logic just after parsing the URL (i.e., after line 49 but before passing todownloadFileFromURL). If the URL does not meet the criteria, exit with an error message.Specifically:
wrapperUrlinmain.httpsand host equal to a well-known Maven server (e.g.,"repo.maven.apache.org"), or a few such hosts if needed.Suggested fixes powered by Copilot Autofix. Review carefully before merging.
Thanks for the PR!
Deployments, as required, will be available below:
Please create PRs in draft mode. Mark as ready to enable:
After merge, new images are deployed in: