Skip to content
This repository was archived by the owner on Apr 8, 2026. It is now read-only.

πŸ›‘οΈ Sentinel: [CRITICAL] Fix missing SSRF protection in public proof bundle example#54

Closed
mapleleaflatte03 wants to merge 1 commit intomainfrom
sentinel-fix-ssrf-examples-6796407046001373342
Closed

πŸ›‘οΈ Sentinel: [CRITICAL] Fix missing SSRF protection in public proof bundle example#54
mapleleaflatte03 wants to merge 1 commit intomainfrom
sentinel-fix-ssrf-examples-6796407046001373342

Conversation

@mapleleaflatte03
Copy link
Copy Markdown
Owner

🚨 Severity: CRITICAL
πŸ’‘ Vulnerability: The functions _fetch_live_manifest and _fetch_live_runtime_proof in examples/generate_public_proof_bundle.py used urllib.request.urlopen on URLs without validating the scheme. This left them vulnerable to SSRF (Server-Side Request Forgery) and arbitrary file reads (e.g., using file:///etc/passwd).
🎯 Impact: An attacker could potentially read internal files or access internal network services if they control the URL inputs to these scripts.
πŸ”§ Fix: Added case-insensitive validation to ensure the URL scheme is strictly http:// or https:// before fetching. It returns a safe error dictionary otherwise.
βœ… Verification: Verified by checking that urlopen in this file is now properly guarded, and running the kernel/tests suite to ensure no regressions.


PR created automatically by Jules for task 6796407046001373342 started by @mapleleaflatte03

Added explicit URL scheme validation to `_fetch_live_manifest` and `_fetch_live_runtime_proof` in `examples/generate_public_proof_bundle.py` to prevent SSRF and arbitrary local file read via `file://` schemes passed to `urllib.request.urlopen`.

Co-authored-by: mapleleaflatte03 <240846662+mapleleaflatte03@users.noreply.github.com>
@google-labs-jules
Copy link
Copy Markdown
Contributor

πŸ‘‹ Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a πŸ‘€ emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

New to Jules? Learn more at jules.google/docs.


For security, I will only act on instructions from the user who triggered this task.

@mapleleaflatte03
Copy link
Copy Markdown
Owner Author

This repository is now archived for historical reference.\n\nActive Meridian development has moved to the monorepo:\nhttps://github.com/mapleleaflatte03/meridian\n\nPlease open a new PR against the monorepo if this change is still needed.

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant