Potential fix for Server-side request forgery #581

New Issue

MrUnknownDE · 2026-04-05T17:22:46+02:00

MrUnknownDE commented

2026-04-05 17:22:46 +02:00

Originally created by @marcschaeferger on 11/29/2025

Community Contribution License Agreement

By creating this pull request, I grant the project maintainers an unlimited,
perpetual license to use, modify, and redistribute these contributions under any terms they
choose, including both the AGPLv3 and the Fossorial Commercial license terms. I
represent that I have the right to grant this license for all contributed content.

Description (generated by Copilot)

See https://codeql.github.com/codeql-query-help/javascript/js-request-forgery/

Code generated by Copilot

This pull request introduces stricter validation for organization and resource identifiers to improve security and consistency across API endpoints. The main changes add UUID format checks for organization IDs in license-related routes and type guard functions for resource and identity provider IDs in server-side actions, with corresponding input validation in proxy functions.

Validation improvements for organization IDs:

Added UUID v4 format validation for orgId in generateNewLicense.ts, ensuring only valid organization IDs are accepted when generating new licenses. [1] [2]
Updated listGeneratedLicenses.ts to require orgId to match a UUID v4 pattern, rejecting invalid or missing organization IDs with a clear error message.

Security enhancements in server-side actions:

Introduced isValidResourceId and isValidIdpId type guard functions in server.ts to validate resource and identity provider IDs, restricting accepted formats.
Added input validation using these type guards in proxy functions (resourcePasswordProxy, resourcePincodeProxy, resourceWhitelistProxy, resourceAccessProxy, validateOidcUrlCallbackProxy, generateOidcUrlProxy), throwing errors for invalid IDs to prevent unsafe requests. [1] [2] [3] [4] [5] [6]
Enforced alphanumeric, dash, and underscore restrictions for orgId in generateOidcUrlProxy to further strengthen input validation.

How to test?

*Originally created by @marcschaeferger on 11/29/2025* ## Community Contribution License Agreement By creating this pull request, I grant the project maintainers an unlimited, perpetual license to use, modify, and redistribute these contributions under any terms they choose, including both the AGPLv3 and the Fossorial Commercial license terms. I represent that I have the right to grant this license for all contributed content. ## Description (generated by Copilot) See https://codeql.github.com/codeql-query-help/javascript/js-request-forgery/ **Code generated by Copilot** This pull request introduces stricter validation for organization and resource identifiers to improve security and consistency across API endpoints. The main changes add UUID format checks for organization IDs in license-related routes and type guard functions for resource and identity provider IDs in server-side actions, with corresponding input validation in proxy functions. **Validation improvements for organization IDs:** * Added UUID v4 format validation for `orgId` in `generateNewLicense.ts`, ensuring only valid organization IDs are accepted when generating new licenses. [[1]](diffhunk://#diff-6c08a641d462a22060ae3f4fdfd0ee0889f7f4ac9f3dfa255a4b1c0568065c47R56-R57) [[2]](diffhunk://#diff-6c08a641d462a22060ae3f4fdfd0ee0889f7f4ac9f3dfa255a4b1c0568065c47R66-R73) * Updated `listGeneratedLicenses.ts` to require `orgId` to match a UUID v4 pattern, rejecting invalid or missing organization IDs with a clear error message. **Security enhancements in server-side actions:** * Introduced `isValidResourceId` and `isValidIdpId` type guard functions in `server.ts` to validate resource and identity provider IDs, restricting accepted formats. * Added input validation using these type guards in proxy functions (`resourcePasswordProxy`, `resourcePincodeProxy`, `resourceWhitelistProxy`, `resourceAccessProxy`, `validateOidcUrlCallbackProxy`, `generateOidcUrlProxy`), throwing errors for invalid IDs to prevent unsafe requests. [[1]](diffhunk://#diff-e10bdddde4c48eed57a2e4ae3149c01574a9ae9fe8f19001704f360a13f579dbR334-R336) [[2]](diffhunk://#diff-e10bdddde4c48eed57a2e4ae3149c01574a9ae9fe8f19001704f360a13f579dbR349-R351) [[3]](diffhunk://#diff-e10bdddde4c48eed57a2e4ae3149c01574a9ae9fe8f19001704f360a13f579dbR364-R366) [[4]](diffhunk://#diff-e10bdddde4c48eed57a2e4ae3149c01574a9ae9fe8f19001704f360a13f579dbR382-R384) [[5]](diffhunk://#diff-e10bdddde4c48eed57a2e4ae3149c01574a9ae9fe8f19001704f360a13f579dbR422-R424) [[6]](diffhunk://#diff-e10bdddde4c48eed57a2e4ae3149c01574a9ae9fe8f19001704f360a13f579dbR442-R447) * Enforced alphanumeric, dash, and underscore restrictions for `orgId` in `generateOidcUrlProxy` to further strengthen input validation. ## How to test?

MrUnknownDE closed this issue

2026-04-05 17:22:46 +02:00

Sign in to join this conversation.

Branches Tags

main

dev

dependabot/npm_and_yarn/dev-minor-updates-b4e5d6b9c5

revert-2766-feature/systemd-install-instructions

dependabot/npm_and_yarn/prod-patch-updates-05702d39f2

dependabot/npm_and_yarn/next-16.2.1

dependabot/npm_and_yarn/recharts-3.8.1

alerting-rules

private-site-ha

dependabot/docker/docker/library/node-25-slim

ssh

delete-account

msg-delivery

org-only-idp

cicd

patch

site-targets-auto-login

No Label

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github/pangolin#581