Navigation guard misses redirect hops to private addresses
还没有人认领这个 Issue。
评估
- 难度
- 3/5
- 预计耗时
- 1-2 天
- 新手友好度
- 68/100
- Issue 类型
- 缺陷
- 描述清晰度
- 描述清楚
- 活跃度
- 活跃
- 技术栈
- typescript
- 领域
- security
调研方向
Read the page.route('**/*') handler and the existing assertPublicUrl and isPublicHost checks; then find the tests for request routing. Add a test where a public URL redirects to a private address, and verify that the redirect is blocked before the browser follows it.
由索引模型根据 Issue 内容生成。
描述
The SSRF guard from #18 checks the initial URL (assertPublicUrl) and every request seen by page.route('**/*'). Playwright only calls the route handler for the first URL in a redirect chain, so a public URL that redirects to a private or link-local address is followed without being checked.
Reproduction (appwrite/browser 0.3.5, Appwrite Cloud staging and production, 2026-10-04/05):
/v1/avatars/screenshots?url=https://httpbin.org/redirect-to?url=http%3A%2F%2F169.254.169.254%2Flatest%2Fmeta-data%2Fpasses the API's URL validator (the initial host is public), and the browser follows the redirect to169.254.169.254. The request timed out after 30s with nothing returned, apparently because the address isn't reachable from the pod. The guard did not stop it.- A direct private URL, or a hostname that resolves privately (
10.0.0.1.nip.io), is refused, but by the API's validator before the browser is involved.
Expected: every hop is checked with isPublicHost, and a redirect to a non-public host aborts the navigation (blockedbyclient).
Possible fix: in the route handler, fetch with redirects disabled (route.fetch({ maxRedirects: 0 })). On a 3xx, resolve Location against the request URL, check it with isPublicHost, and either abort or route.fulfill the redirect response so the browser re-requests the next hop, which passes through the handler again. Add a test with a public redirect to a private address.
Context: appwrite-labs/cloud#6236 (cloud runs 0.3.5 since 2026-10-05).
- 主要语言
- TypeScript
- 星标
- 8
- 派生
- 2
- 平均合并
- 21 分钟
- 30 天内合并 PR
- 2
环境准备
- 提供 Dockerfile 或 Docker Compose 文件
- 没有 Pull Request 模板
- 阅读贡献指南
从这里开始
- 先读完整个 Issue，再读项目的贡献指南。
- 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
- Fork 仓库，在一个分支上完成修改。
- 提交 Pull Request，并在描述里引用这个 Issue 编号。
appwrite/docker-browser 的其他 Issue
-
documentation
难度 2/5 1-3 小时 新手友好度 52/100
appwrite/docker-browser#15 ·
查看 appwrite/docker-browser 的全部 Issue
相似的 Issue
-
难度 2/5 1-3 小时 新手友好度 78/100
JoviDeCroock/pracht#432 ·
维护者通常 1 天内回复
-
approved check:passed streams:add
难度 1/5 1 小时以内 新手友好度 75/100
维护者通常 1 天内回复
-
Hardware attribute name "app Connection Support" has inconsistent casing可能已有人在做 关联的 PR 仍在进行中或已合并。 未关闭
难度 1/5 1 小时以内 新手友好度 88/100
walletbeat/walletbeat#1628 ·
维护者通常 1 天内回复
-
bug go
难度 2/5 1-3 小时 新手友好度 82/100
genkit-ai/genkit#6761 · 1 条评论 ·
维护者通常 2 天内回复
-
难度 2/5 1-3 小时 新手友好度 72/100
NousResearch/hermes-agent#136483 ·
维护者通常 1 天内回复