mirror of
https://github.com/diegosouzapw/OmniRoute.git
synced 2026-08-19 13:42:09 +03:00
df2379053e
POST /api/providers fires a credential-bearing self-fetch to the new connection's /sync-models route (forwarding the management cookie + internal sync auth headers). #3267 built that origin from new URL(request.url).origin — the client-controlled Host header — so a (management-authenticated) caller could redirect the internal request to an arbitrary host, exfiltrating the internal sync auth token (CodeQL js/request-forgery, critical, alert #323). Derive the origin from the trusted loopback/env-pinned base URL via a new getModelSyncInternalBaseUrl() helper (same source the model-sync scheduler already uses), never from the incoming request. Adds a regression test.