fix(security): open redirect, stored XSS, and postMessage origin hardening - #96
Open
dinex-dev wants to merge 3 commits into
Open
fix(security): open redirect, stored XSS, and postMessage origin hardening#96dinex-dev wants to merge 3 commits into
dinex-dev wants to merge 3 commits into
Conversation
LoginHandler.redirect() opened any cross-origin URL via window.open, allowing an attacker-supplied redirectURL/redirectURI to send an authenticated user to an external phishing page after login. Route non-same-origin targets to redirectToHome instead of opening them. Same-origin redirects are unaffected and still preserve the user's original request path. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
ReactMarkdown was configured with rehypeRaw, which re-parses raw HTML in Markdown source into live DOM nodes. In the API Client collection description (user-editable, persisted to Firebase, shown to teammates) this allowed stored XSS via payloads like <img src=x onerror=...>. Drop rehypeRaw from CollectionOverview and BaseBanner so ReactMarkdown falls back to its safe default (raw HTML escaped). Standard Markdown via remark-gfm is unaffected. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
…WE-79) The rule editor's message listener accepted any message whose body contained author:"requestly"/action:"ruleEditor:loadData" with no event.origin check, so any web page could open the editor in a popup and inject attacker-supplied ruleData (e.g. a malicious Script rule). Reject messages unless event.origin is the app's own origin or a Requestly extension origin (chrome/moz/safari-web-extension scheme). This preserves the intended DevTools "create rule from traffic" flow (a chrome-extension:// sender) while blocking arbitrary web origins. The outbound ready-event postMessage still uses "*", but only leaks a blank default rule template in CREATE mode; tightening its target origin needs a coordinated extension change and is left as follow-up. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fixes for several security findings from the AppSec review (umbrella: APPSEC-398). Three code changes, each self-contained.
Tickets addressed
LoginHandler.redirect()opened any cross-origin URL viawindow.open; now cross-origin targets fall back toredirectToHomeinstead of being followed. Same-origin redirects (the normal "return to the page you were on" flow) are unaffected.rehype-rawin the API Client collection description (CWE-79). RemovedrehypeRawso ReactMarkdown falls back to its safe default (raw HTML escaped). Standard Markdown viaremark-gfmis unaffected.rehype-rawstored-XSS pattern in the app notification banner (BaseBanner), fixed in the same commit as RQ-2304.postMessagelistener had noevent.origincheck (CWE-79). Now validates the sender origin against the app's own origin and the browser-extension schemes, preserving the DevTools "create rule from traffic" flow while blocking arbitrary web origins. The outbound wildcard target is documented as an accepted risk in-code (CREATE-mode default template only; tightening needs a coordinated extension change).Testing
tsc --noEmitclean for all changed files (pre-existing unrelated type errors left untouched).🤖 Generated with Claude Code