Security/fixing vulnerabilities#1779
Merged
Merged
Conversation
Reject cross-origin fetches to private and loopback addresses, validate redirect targets manually, and extend the changeset to cover both advisories. Co-authored-by: Cursor <cursoragent@cursor.com>
Malicious OpenAPI specs could break out of string literals in axios and fetch client constructors via unescaped servers[0].url, leading to arbitrary code execution when consumers instantiate HttpClient. Co-authored-by: Cursor <cursoragent@cursor.com>
Malicious OpenAPI specs could inject executable JavaScript via enum string
values (module-load RCE on import) and path keys (${…} in template literals
on every method call). Ts.StringValue now escapes string literals; route paths
are sanitized before deliberate path-param interpolations are inserted.
Co-authored-by: Cursor <cursoragent@cursor.com>
🦋 Changeset detectedLatest commit: 7f77496 The changes in this PR will be included in the next version bump. This PR includes changesets to release 1 package
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
Co-authored-by: Cursor <cursoragent@cursor.com>
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
There was a problem hiding this comment.
4 issues found across 19 files
Reply with feedback, questions, or to request a fix.
Re-trigger cubic
Strip brackets from URL.hostname for IPv6 literals so net.isIP() and dns.lookup() work correctly. Handle hex-hextet normalized IPv4-mapped IPv6 addresses in isPrivateIpv6. Replace placeholder-based roundtrip in escapeJsTemplateLiteralWithPathParams with a collision-free single-pass algorithm. Make baseUrl injection test assertion quote-style-agnostic. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
Replace ad-hoc replace(/"/g, '\\"') with JSON.stringify().slice(1, -1) which correctly handles backslashes and control characters too. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary by cubic
Hardens
swagger-typescript-apiagainst code injection and SSRF by escaping untrusted OpenAPI inputs and enforcing safe remote$reffetching. Covers IPv6 and placeholder-collision edge cases.Bug Fixes
servers[0].urlbefore rendering to stop baseUrl injection in axios/fetch clients.${param}placeholders; use a single-pass algorithm to avoid placeholder collisions.$refhardening: block private/loopback/link-local addresses andlocalhostfor cross-origin fetches; handle IPv6 literals and IPv4-mapped IPv6 correctly (strip brackets, detect hex-hextet forms); allow same-origin and the explicit spec--url; manually follow up to 5 redirects with re-validation; forwardauthorizationTokenonly to same-origin URLs.Migration
staCLI alias forswagger-typescript-api; no action needed.Written for commit 7f77496. Summary will update on new commits.