Diego Rodrigues de Sa e Souza 630680067c fix(security): block cloud-metadata SSRF pivot in cli-tools catalog fetch (CodeQL #326 critical) (#3544) ...

assertSafeCatalogUrl() blocks the cloud-metadata/link-local SSRF→IAM pivot + non-http(s) + embedded creds before the user-controlled baseUrl reaches fetch; loopback (the legitimate OmniRoute target) and public OmniRoute Cloud stay allowed. Fetches the re-parsed (taint-severed) URL. TDD: 4 guard cases. CodeQL FP (custom-guard limitation) dismissed per Rule #14. Folded into v3.8.19.

2026-06-10 02:20:21 -03:00

..

config-generator.test.ts

fix(security): block cloud-metadata SSRF pivot in cli-tools catalog fetch (CodeQL #326 critical) (#3544)

2026-06-10 02:20:21 -03:00

tool-detector.test.ts

Release v3.8.6 (#2804)

2026-05-29 12:44:29 -03:00