Files
OmniRoute/tests/unit
Xiangzhe 5d1055f3fc fix(security): validate the AWS region on the device-code route (SSRF)
The kiro / amazon-q device-code action interpolated a caller-supplied `region`
into the AWS OIDC endpoint URLs that requestDeviceCode() fetches, with no
validation — an attacker-shaped region (userinfo/fragment) could re-point the
outbound host to an internal target or the cloud-metadata service. `region` is
now checked against the canonical AWS region shape (AWS_REGION_PATTERN, already
used by pollToken) and rejected with a 400 before any outbound fetch.

Reported by @daniel-mertz via GHSA-7x63-xvp5-w2jc.
2026-08-21 14:12:55 -03:00
..