fix: address critical security vulnerabilities - #4
Open
devin-ai-integration[bot] wants to merge 1 commit into
Open
fix: address critical security vulnerabilities#4devin-ai-integration[bot] wants to merge 1 commit into
devin-ai-integration[bot] wants to merge 1 commit into
Conversation
- Prevent stack trace and exception detail leakage to clients - Add SSRF protection via URL host allowlist (www.bing.com, sydney.bing.com) - Add optional token-based authentication via AUTH_TOKEN env var - Add per-IP rate limiting (60 req/min) - Harden Dockerfile: multi-stage build, non-root user, .dockerignore - Replace slf4j-log4j12 with slf4j-simple to avoid log4j 1.x CVEs Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Author
🤖 Devin AI EngineerI'll be helping with this pull request! Here's what you should know: ✅ I will automatically:
Note: I can only respond to comments from users who have write access to this repository. ⚙️ Control Options:
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Security audit and fixes for the proxy server. Six issues addressed:
CRITICAL — Information leakage via error responses
getReturnError(Throwable)was serializing full Java stack traces into JSON responses sent to clients, exposing internal class paths, library versions, and server internals. The WebSocketonErrorhandler inNewBingGoGoClientWebSocketsimilarly embeddedex.toString()in client-facing messages. Both now log server-side only and return generic error messages to clients.CRITICAL — SSRF via open proxy target
goUrl()accepted any URL constructed from the request path. Added a host allowlist (ALLOWED_PROXY_HOSTS = {"www.bing.com", "sydney.bing.com"}) validated beforeopenConnection().HIGH — No authentication
Added optional token-based auth gated by
AUTH_TOKENenv var. When set, requests must include the token as?auth_token=<val>orX-Auth-Tokenheader. When unset, behavior is unchanged (open access).HIGH — No rate limiting
Added per-IP sliding-window rate limiter (60 req/min) using
ConcurrentHashMap<String, RateLimitEntry>with periodic cleanup. Applied to both HTTP and WebSocket endpoints.MEDIUM — Dockerfile runs as root, leaks source
Rewrote as multi-stage build:
gradle:8.0.2-jdk17builder →eclipse-temurin:17-jreruntime with dedicatedappuser. Added.dockerignoreexcluding.git, build artifacts, IDE configs.MEDIUM — Insecure transitive dependency
Replaced
slf4j-log4j12(which pulls in log4j 1.x with known CVEs) withslf4j-simple.Link to Devin session: https://app.devin.ai/sessions/d9c9a553648a4ff4b5be64a817549b82
Requested by: @oneky