From 535c75b60a13b8b0c5308c868e11aed59a129c77 Mon Sep 17 00:00:00 2001 From: diegosouzapw Date: Thu, 6 Aug 2026 19:09:49 -0300 Subject: [PATCH] fix(security): parse and compare hostname instead of substring match in Adobe Firefly login MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Replace request.url.includes(FIREFLY_3P_HOST_SUFFIX) with parsed-hostname comparison (anchored endsWith), closing CodeQL alert #778. The old substring check could be bypassed by an attacker-controlled page visited during the browser login window — a URL like 'https://evil.com/firefly-3p.ff.adobe.io' would pass the gate and its Bearer token would be captured as the Adobe credential. Practical severity is low (only during operator-initiated, time-boxed login on a temp-profile browser), but the fix is one line and matches the dot-anchored idiom used in docker/devin-bridge/network-guard/. Closes code-scanning #778. --- open-sse/services/adobeFireflyBrowserLogin.ts | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/open-sse/services/adobeFireflyBrowserLogin.ts b/open-sse/services/adobeFireflyBrowserLogin.ts index 9df37023d3..1482971c3e 100644 --- a/open-sse/services/adobeFireflyBrowserLogin.ts +++ b/open-sse/services/adobeFireflyBrowserLogin.ts @@ -259,7 +259,14 @@ async function captureViaCdp(opts: { if (capturedAccessToken) return; const request = params.request as { url?: string; headers?: Record } | undefined; - if (!request?.url || !request.url.includes(FIREFLY_3P_HOST_SUFFIX)) return; + if (!request?.url) return; + let host: string; + try { + host = new URL(request.url).hostname.toLowerCase(); + } catch { + return; + } + if (host !== FIREFLY_3P_HOST_SUFFIX && !host.endsWith(`.${FIREFLY_3P_HOST_SUFFIX}`)) return; const headers = request.headers || {}; const auth = headers.Authorization || headers.authorization || headers.AUTHORIZATION || ""; const token = extractAdobeBearerTokenFromAuthorization(auth);