pjandro/OmniRoute
1
0
Fork 0
mirror of https://github.com/diegosouzapw/OmniRoute.git synced 2026-08-08 00:02:20 +03:00
Code Issues Packages Projects Releases Wiki Activity

fix(security): anchor hostname comparison in Adobe Firefly login (#778)

Browse Source 
Parse and compare hostname with dot-anchored endsWith instead of substring includes. Closes code-scanning #778.
This commit is contained in:
Diego Rodrigues de Sa e Souza
2026-08-06 23:12:54 -03:00
committed by GitHub
parent c9a3361e5a 535c75b60a
commit 9995bc4893
1 changed files with 8 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
open-sse/services/adobeFireflyBrowserLogin.ts
View File

@@ -259,7 +259,14 @@ async function captureViaCdp(opts: {
if (capturedAccessToken) return; if (capturedAccessToken) return;
const request = params.request as const request = params.request as
{ url?: string; headers?: Record<string, string> } | undefined; { url?: string; headers?: Record<string, string> } | undefined;
if (!request?.url || !request.url.includes(FIREFLY_3P_HOST_SUFFIX)) return; if (!request?.url) return;
let host: string;
try {
host = new URL(request.url).hostname.toLowerCase();
} catch {
return;
}
if (host !== FIREFLY_3P_HOST_SUFFIX && !host.endsWith(`.${FIREFLY_3P_HOST_SUFFIX}`)) return;
const headers = request.headers || {}; const headers = request.headers || {};
const auth = headers.Authorization || headers.authorization || headers.AUTHORIZATION || ""; const auth = headers.Authorization || headers.authorization || headers.AUTHORIZATION || "";
const token = extractAdobeBearerTokenFromAuthorization(auth); const token = extractAdobeBearerTokenFromAuthorization(auth);