Xiangzhe 5d1055f3fc fix(security): validate the AWS region on the device-code route (SSRF) ...

The kiro / amazon-q device-code action interpolated a caller-supplied `region`
into the AWS OIDC endpoint URLs that requestDeviceCode() fetches, with no
validation — an attacker-shaped region (userinfo/fragment) could re-point the
outbound host to an internal target or the cloud-metadata service. `region` is
now checked against the canonical AWS region shape (AWS_REGION_PATTERN, already
used by pollToken) and rejected with a 400 before any outbound fetch.

Reported by @daniel-mertz via GHSA-7x63-xvp5-w2jc.

2026-08-21 14:12:55 -03:00

..

_helpers

…

_setup

…

benchmarks

…

boundary

…

e2e

fix(providers): validate bailian-coding-plan against the Token Plan host (#10634)

2026-08-18 05:51:34 -03:00

fixtures

feat(providers): add local ZCode ACP backend (#10184)

2026-08-16 00:13:36 -03:00

golden-set

…

helpers

fix(responses): replace synthetic reasoning keepalive (#10806)

2026-08-20 09:49:55 -03:00

homolog

…

integration

fix(cline): stop generating proxy task ids (#10279)

2026-08-21 02:13:00 -03:00

live

…

llm-security

…

load

…

manual

…

security

…

snapshots

fix(cline): stop generating proxy task ids (#10279)

2026-08-21 02:13:00 -03:00

translator

…

unit

fix(security): validate the AWS region on the device-code route (SSRF)

2026-08-21 14:12:55 -03:00

_cp_mock_hook.mts

…

_cp_mock_module.mts

…

_run_dns_guard_test.sh

…

e2e-tool-calls.sh

…

theoldllm-stress.test.ts

…