fix(controlplane): close jul 20-21 vulnerability audit findings#2749
Merged
Conversation
scope GetAPIKeys to the caller's personal keys, require project manage to refresh portal auth tokens, block portal tokens on broadcast/fanout/dynamic, require manage for bulk onboard and openapi import, and canonicalize cloud billing checkout hosts.
…l metadata endpoints_metadata no longer embeds signing secrets, and soft-deleted endpoints are excluded from joins and owner counts.
disable IsExternalRefsAllowed so import cannot fetch remote \$ref urls. fail closed with a unit test for an external https ref.
match process_event_creation so unlicensed instances use the raw payload instead of running transform functions on broker ingest.
…rify prevents replaying a captured verification token until its previous ttl.
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
…t counts reject portal tokens on refresh_token so they cannot mint another link's auth_key, and count only non-deleted endpoints in the empty-owner_id branch.
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit ed4c0fb. Configure here.
…mport requireJWTProjectManage skips portal credentials; these handlers have no owner scoping, so portal callers must fail closed before the manage gate.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
endpoints_metadatano longer includes signing secrets or soft-deleted endpoints; cloud billing checkout hosts are canonicalized before use.$reffetches, pub/sub transforms honor the Transformations license, and email verification tokens are cleared after successful verify.Test plan
secretsinendpoints_metadata$refsNote
High Risk
Touches authentication, authorization, API key listing, portal credential exposure, billing redirect hosts, and OpenAPI import—security-critical paths where regressions could block legitimate users or leave holes if checks are wrong.
Overview
This PR hardens authorization and closes several credential/exposure gaps from a security audit.
API authorization: A shared
rejectPortalLinkTokenhelper returns 401 for portal-link credentials on project-wide mutations—broadcast, fanout, and dynamic events; bulk onboard; OpenAPI import; and portal auth-token refresh. Bulk onboard and OpenAPI import also require project manage for JWT/PAT callers. Portal token refresh now requires project manage (not view alone). The dashboard GetAPIKeys route always scopes to the authenticated user’s personal keys and rejects otherkeyTypevalues, fixing a case where an empty filter could list every key on the instance.Data exposure: Portal link SQL no longer embeds endpoint signing secrets in
endpoints_metadata, excludes soft-deleted endpoints from joins and counts, and tests assert secrets stay out of responses. Cloud billing onboard/upgrade checkout flows canonicalizehostviavalidatePlanAndHostbefore calling billing.Other gates: OpenAPI import disables external
$refresolution (SSRF); pub/sub body/header transforms run only when the Transformations license is enabled; successful email verification clears the verification token and expiry.Reviewed by Cursor Bugbot for commit 72cbe46. Bugbot is set up for automated code reviews on this repo. Configure here.