[dev] [tofikwest] tofik/custom-domain-issue#2329
Conversation
…PI integration - Added logic to trigger Vercel domain verification for SSL provisioning, ensuring domains are active without manual intervention. - Updated verification checks to account for Vercel domains, improving the accuracy of the verification process. - Introduced error handling for Vercel API calls to log warnings without failing the domain verification flow.
PR SummaryMedium Risk Overview After marking a domain verified/published in the DB, it now best-effort triggers Vercel domain re-verification ( Written by Cursor Bugbot for commit 06a9336. This will update automatically on new commits. Configure here. |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| await this.vercelApi.post( | ||
| `/v9/projects/${process.env.TRUST_PORTAL_PROJECT_ID}/domains/${domain}/verify`, | ||
| {}, | ||
| { params: { teamId: process.env.VERCEL_TEAM_ID } }, | ||
| ); |
Check failure
Code scanning / CodeQL
Server-side request forgery Critical
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 1 day ago
General approach: ensure that any user-controlled value used in the URL of an outgoing request is either (1) strictly validated against a whitelist pattern and rejected if invalid, and/or (2) safely encoded so it cannot change the structure of the URL (e.g., cannot inject extra /, ?, #, etc.). For domains, the safest is to validate them against a DNS-hostname regex and then, when building a URL path segment, encode them with encodeURIComponent or use axios’ url/params in a way that treats them as data, not structure.
Best fix here: reuse the existing validateDomain logic for checkDnsRecords (already present and called at line 903) to guarantee that domain is a syntactically valid DNS hostname, and then also encode the domain when embedding it in the Vercel URL path. This means:
- Do not trust that all internal callers always go through
checkDnsRecords; defensive coding at the sink is cheap and robust. - Convert the Vercel call from:
to:
`/v9/projects/${process.env.TRUST_PORTAL_PROJECT_ID}/domains/${domain}/verify`const safeDomain = encodeURIComponent(domain); `/v9/projects/${process.env.TRUST_PORTAL_PROJECT_ID}/domains/${safeDomain}/verify`
- Optionally, call
this.validateDomain(domain)again right before building the URL. This ensures that even ifcheckDnsRecordsis ever reused or refactored, the sink remains safe.
Concretely, within apps/api/src/trust-portal/trust-portal.service.ts, in the checkDnsRecords method near lines 1023–1038:
- Introduce a local
const safeDomain = encodeURIComponent(domain);inside theif (process.env.TRUST_PORTAL_PROJECT_ID && process.env.VERCEL_TEAM_ID)block, before callingthis.vercelApi.post. - Use
safeDomaininstead ofdomainin the URL template string. - Optionally, add
this.validateDomain(domain);at the start of thatifblock as a belt-and-suspenders validation (cheap and uses existing code).
No new imports or external libraries are needed; encodeURIComponent is built-in.
| @@ -1024,9 +1024,12 @@ | ||
| // Without this, Vercel doesn't know DNS has been configured and the domain stays inactive | ||
| // (previously required CS to manually click "Refresh" in Vercel dashboard). | ||
| if (process.env.TRUST_PORTAL_PROJECT_ID && process.env.VERCEL_TEAM_ID) { | ||
| // Defensive: ensure the domain is valid and safely encoded before using it in a URL path segment. | ||
| this.validateDomain(domain); | ||
| const safeDomain = encodeURIComponent(domain); | ||
| try { | ||
| await this.vercelApi.post( | ||
| `/v9/projects/${process.env.TRUST_PORTAL_PROJECT_ID}/domains/${domain}/verify`, | ||
| `/v9/projects/${process.env.TRUST_PORTAL_PROJECT_ID}/domains/${safeDomain}/verify`, | ||
| {}, | ||
| { params: { teamId: process.env.VERCEL_TEAM_ID } }, | ||
| ); |
|
🎉 This PR is included in version 3.9.0 🎉 The release is available on GitHub release Your semantic-release bot 📦🚀 |
|
The latest updates on your projects. Learn more about Vercel for GitHub.
2 Skipped Deployments
|
2 participants
This is an automated pull request to merge tofik/custom-domain-issue into dev.
It was created by the [Auto Pull Request] action.