fix: address 6 security vulnerabilities - #59
Conversation
- HIGH: Validate download URLs require HTTPS scheme (SSRF prevention) - HIGH: Strip auth headers on cross-host redirects (token leakage) - MEDIUM: Sandbox PKL evaluator by disabling http/https modules/resources - MEDIUM: Sanitize Destination path to prevent directory traversal - MEDIUM: Replace try! with throwing makeRequest in UpdateVariablesEndpoint - MEDIUM: Normalize templates path via resolvingSymlinksInPath Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Summary of ChangesHello @alexey1312, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request significantly enhances the security posture and stability of the application by addressing six identified vulnerabilities. Key improvements include stricter URL validation for downloads, preventing sensitive header leakage during redirects, sandboxing the PKL evaluator to restrict network access, and fortifying path handling against directory traversal attacks. Additionally, it refines error handling for API requests, contributing to a more robust and secure system. Highlights
Changelog
Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here. You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension. Footnotes
|
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
The pull request effectively addresses the 6 identified security vulnerabilities. It implements HTTPS enforcement for downloads, strips sensitive headers on cross-host redirects, sandboxes the PKL evaluator, prevents directory traversal in file destinations, improves error handling by removing try!, and normalizes template paths. These changes significantly harden the tool against common attack vectors like SSRF, credential leakage, and path traversal.
- CRITICAL: add HTTPS validation to SharedDownloadQueue batch downloads - CRITICAL: make RedirectGuardDelegate fail-closed on nil hosts - HIGH: strip headers on HTTPS→HTTP scheme downgrade in redirects - HIGH: add @unchecked Sendable and internal access to RedirectGuardDelegate - HIGH: fix orphaned doc comment in PKLEvaluator - HIGH: replace fatalError with throw in 3 endpoint makeRequest methods - MEDIUM: guard against empty path after sanitization in Destination.url - MEDIUM: add 13 security tests (path traversal, redirect guard, endpoints)
1 participant
Summary
FileDownloader(SSRF prevention)X-Figma-TokenandAuthorizationheaders on cross-host redirects viaRedirectGuardDelegatehttp:/https:from allowed modules and resourcesDestination.urlrelative path to prevent../directory traversaltry!with throwingmakeRequestinUpdateVariablesEndpoint(crash prevention)templatesPathviaresolvingSymlinksInPath()in all 4 export modulesTest plan
exfig.pklwithpackage://imports) is not affected🤖 Generated with Claude Code