π‘οΈ Sentinel: [CRITICAL] Fix missing SSRF protection in public proof bundle example#54
Conversation
Added explicit URL scheme validation to `_fetch_live_manifest` and `_fetch_live_runtime_proof` in `examples/generate_public_proof_bundle.py` to prevent SSRF and arbitrary local file read via `file://` schemes passed to `urllib.request.urlopen`. Co-authored-by: mapleleaflatte03 <240846662+mapleleaflatte03@users.noreply.github.com>
|
π Jules, reporting for duty! I'm here to lend a hand with this pull request. When you start a review, I'll add a π emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down. I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job! For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with New to Jules? Learn more at jules.google/docs. For security, I will only act on instructions from the user who triggered this task. |
|
This repository is now archived for historical reference.\n\nActive Meridian development has moved to the monorepo:\nhttps://github.com/mapleleaflatte03/meridian\n\nPlease open a new PR against the monorepo if this change is still needed. |
π¨ Severity: CRITICAL
π‘ Vulnerability: The functions
_fetch_live_manifestand_fetch_live_runtime_proofinexamples/generate_public_proof_bundle.pyusedurllib.request.urlopenon URLs without validating the scheme. This left them vulnerable to SSRF (Server-Side Request Forgery) and arbitrary file reads (e.g., usingfile:///etc/passwd).π― Impact: An attacker could potentially read internal files or access internal network services if they control the URL inputs to these scripts.
π§ Fix: Added case-insensitive validation to ensure the URL scheme is strictly
http://orhttps://before fetching. It returns a safe error dictionary otherwise.β Verification: Verified by checking that
urlopenin this file is now properly guarded, and running thekernel/testssuite to ensure no regressions.PR created automatically by Jules for task 6796407046001373342 started by @mapleleaflatte03