mirror of
https://github.com/software-mansion/argent.git
synced 2026-09-14 19:27:14 +08:00
Ignacy Łątka
6ec992d936
doRegister() fetched the sourceMapURL from a Debugger.scriptParsed CDP event with no URL validation. Combined with the no-auth tool-server HTTP surface, a malicious app — or any caller of debugger-evaluate / debugger-connect — could inject a script whose //# sourceMappingURL pointed at an attacker-chosen URL. The tool-server would then dutifully fetch it, turning it into a blind SSRF probe of the host network (internal services, AWS metadata at 169.254.169.254, intranet pages, etc.). Adds isAllowedSourceMapURL(): only http/https URLs whose hostname is localhost, 127.0.0.1, or ::1 (IPv6 brackets stripped). Anything else, including malformed URLs and file:// schemes, is rejected and the map is silently skipped. The data: URI branch is untouched — those are inline and don't fetch.