Common Client - DO NOT MERGE #1
Conversation
# Conflicts: # agent/package.json # pnpm-lock.yaml
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
There was a problem hiding this comment.
Hi @timolegros! Welcome to the ai16z community. Thanks for submitting your first pull request; your efforts are helping us accelerate towards AGI. We'll review it shortly. You are now a ai16z contributor!
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| // Fetch full content from R2 if not all content fit in `object_summary` | ||
| let content = req.body.object_summary; | ||
| if (req.body.content_url) { | ||
| const contentResponse = await fetch(req.body.content_url); |
Check failure
Code scanning / CodeQL
Server-side request forgery Critical
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix AI 14 days ago
To fix the problem, we need to validate and sanitize the user-provided URL before using it in the fetch request. The best way to do this is to use an allow-list of trusted domains and ensure that the URL belongs to one of these domains. Additionally, we should validate the URL structure to prevent path traversal and other malicious manipulations.
- Create an allow-list of trusted domains.
- Parse the user-provided URL and check if its hostname is in the allow-list.
- If the URL is valid, proceed with the
fetchrequest; otherwise, return an error response.
| @@ -199,3 +199,16 @@ | ||
| if (req.body.content_url) { | ||
| const contentResponse = await fetch(req.body.content_url); | ||
| const allowedDomains = ["trusted.com", "another-trusted.com"]; | ||
| const url = new URL(req.body.content_url); | ||
|
|
||
| if (!allowedDomains.includes(url.hostname)) { | ||
| elizaLogger.error( | ||
| "❌ [ERROR] Invalid content URL:", | ||
| req.body.content_url | ||
| ); | ||
| return res.status(400).send({ | ||
| error: "Invalid content URL", | ||
| }); | ||
| } | ||
|
|
||
| const contentResponse = await fetch(url.toString()); | ||
|
|
Introduce sentient AI to DePIN plugin
Orchestrator architecture V1
This PR exists only to demonstrate the changelist in anticipation of a PR against the elizaOS repo.
TODO
COMMON_USER_IDenv var when new Common Api Client is published with GetUser route