Bryan Helmkamp ec33c6a0ea security(install): sanitize upstream URLs before issuing HTTP requests ... CodeQL's Rust SSRF detector flagged the GitHub-and-provider HTTP calls in install mode because the `base_url` values flow through `pub` test-only setters (`with_github_api_base_url`, `with_provider_base_url`) that the analyzer treats as external entry points. In production these values are always the hardcoded `DEFAULT_*` constants, so the flagged paths are unreachable, but the fix also hardens the real request sites. Route every upstream URL through `parse_install_upstream_url`, which - parses the URL, - requires the scheme to be `http` or `https`, and - requires a host. Build request endpoints via `install_upstream_endpoint(base, &[segments])` so each segment is percent-encoded by `url`; a caller cannot inject extra path components, host overrides, or scheme changes via a path segment. GitHub's manifest `code` (from the browser callback) is also checked against the short base64url character set it uses. Closes code-scanning alerts #28 and #29. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>		2026-04-19 15:14:29 -04:00
..
crates	security(install): sanitize upstream URLs before issuing HTTP requests	2026-04-19 15:14:29 -04:00
packages/fabro-api-client	Merge remote-tracking branch 'origin/main' into feat/web-install-wizard	2026-04-19 15:06:12 -04:00