Fix/security validate profile image url#382
Open
Sharaf0 wants to merge 23 commits into
Open
Conversation
Sharaf0
force-pushed
the
fix/security-validate-profile-image-url
branch
from
7c892fb to
15f6eed
Compare
Add server-side validation for pictureLink URLs on corpUserEditableInfo and corpGroupEditableInfo aspects. The new UrlValidator: - Enforces HTTPS-only scheme (blocks http, javascript, data, file, etc.) - Blocks internal/private network addresses (localhost, 127.0.0.1, ::1, 169.254.169.254, RFC1918 ranges) to prevent SSRF attacks - Allows the default avatar relative path (assets/...) - Rejects URLs with unresolvable hostnames Includes 12 unit tests covering valid URLs, scheme enforcement, and internal host blocking.
…ose() from after the mutation promise chain into the .then() block so the modal stays open when the server rejects the input (e.g. URL validation failure). Previously the modal closed immediately on save, giving the false impression that the change was persisted.
When the mutation to update profile is rejected by the server (e.g. invalid URL), reset both the React state and antd form fields back to the original editModalData values. This prevents the rejected value from persisting in the modal when it is reopened.
Skip validation for empty or blank URLs so users can clear their profile image. Adds testEmptyPictureLinkAllowed test case.
Add configuration flags for the UrlValidator under metadataChangeProposal.validation.urlValidation: - enabled: enable/disable the validator (default: true) - allowHttp: allow http:// URLs in addition to https:// (default: false) - extraDenyHosts: additional hostnames/IPs to block - extraDenyCidrs: reserved for future CIDR-based blocking Wire configuration through UrlValidationConfig POJO, MCPValidationConfig, and SpringStandardPluginConfiguration with @ConditionalOnProperty for the enabled flag. Add 3 new tests covering allowHttp and extraDenyHosts configuration.
Sharaf0
force-pushed
the
fix/security-validate-profile-image-url
branch
from
75ebcca to
bf29741
Compare
Add metadataChangeProposal.validation.urlValidation.* properties to NON_SENSITIVE_PROPERTIES in PropertiesCollectorConfigurationTest to fix CI validation.
Sharaf0
force-pushed
the
fix/security-validate-profile-image-url
branch
from
bf29741 to
afeb023
Compare
…ature-availability stages (datahub-project#17091) Co-authored-by: Jay <159848059+jayacryl@users.noreply.github.com>
Lombok skips generating setAllowHttp when it sees a hand-written one, so allowedSchemes stays in sync automatically — no separate buildSchemes() call to forget. Also removes unused extraDenyCidrs config. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
![aikido-pr-checks[bot]](https://avatars.githubusercontent.com/in/898896?s=60&v=4){kind=small}
| } | ||
|
|
||
| try { | ||
| InetAddress address = InetAddress.getByName(host); |
There was a problem hiding this comment.
HTTP request might enable SSRF attack - critical severity
If an attacker can control the URL input leading into this http request, the attack might be able to perform an SSRF attack. This kind of attack is even more dangerous is the application returns the result of the URL fetch to the user. It can serve as an initial access point for an attacker for stealing credentials in the cloud.
Show fix
Remediation: If possible, only allow requests to verified domains. If not, consult the article linked above to learn about other mitigating techniques such as disabling redirects, blocking private IPs and making sure private services have internal authentication. If you return data coming from the request to the user, validate the data before returning it to make sure you don't return random data.
Reply @AikidoSec ignore: [REASON] to ignore this issue.
More info
…roject#16842) Co-authored-by: Michael Maltese <michaeljosephmaltese@gmail.com>
…atahub-project#17384) Co-authored-by: Cursor <cursoragent@cursor.com>
…7386) Co-authored-by: Cursor <cursoragent@cursor.com>
…17365) Co-authored-by: Cursor <cursoragent@cursor.com>
Sharaf0
force-pushed
the
fix/security-validate-profile-image-url
branch
from
5e7bd21 to
7585b6a
Compare
…date-profile-image-url
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
11 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds server-side validation for
pictureLinkURL fields oncorpUserEditableInfoandcorpGroupEditableInfoaspects to prevent browser-side SSRF, credential harvesting, and content injection attacks via the "Edit Profile → Image URL" field.Previously, any arbitrary URL (including
javascript:,data:,file:, or internal network addresses) could be stored as a profile image URL with no validation at any layer.What Changed
New:
UrlValidator(metadata-io)An
AspectPayloadValidatorplugin that validatespictureLinkURLs before persistence:http://,javascript:,data:,file:, and other non-HTTPS schemeslocalhost,127.0.0.1,::1,169.254.169.254(cloud metadata endpoint), and all RFC 1918 private ranges (10.x,172.16-31.x,192.168.x)assets/…used for default avatars continues to workModified:
SpringStandardPluginConfiguration(metadata-service/factories)Registered the
UrlValidatorbean forcorpuser/corpUserEditableInfoandcorpGroup/corpGroupEditableInfoonCREATE,CREATE_ENTITY,UPSERT,UPDATE, andPATCHoperations.Updated:
docs/how/updating-datahub.mdAdded an entry under "Other Notable Changes" documenting the behavioral change.
Testing
javascript:rejection,data:rejection,file:rejection, localhost blocking, cloud metadata IP blocking, loopback IP blocking, private network IP blocking, corp group validation, andisInternalHost()unit testsChecklist