🛡️ Sentinel: [HIGH] Fix SSRF in Bulk Lookup API#136
Open
aicoder2009 wants to merge 1 commit into
Open
Conversation
Removed loopback fetch requests in `src/app/api/lookup/bulk/route.ts` which relied on the user-controlled `request.nextUrl.origin` and HTTP Host header. Replaced with direct invocation of Next.js Route Handlers using a synthesized `NextRequest` to eliminate the SSRF vector and improve API performance. Also added test mocks. Co-authored-by: aicoder2009 <127642633+aicoder2009@users.noreply.github.com>
Contributor
|
👋 Jules, reporting for duty! I'm here to lend a hand with this pull request. When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down. I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job! For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with New to Jules? Learn more at jules.google/docs. For security, I will only act on instructions from the user who triggered this task. |
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
📝 WalkthroughWalkthroughThe PR refactors the bulk lookup API to prevent SSRF by eliminating loopback ChangesSSRF Prevention via Direct Handler Invocation
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~25 minutes Poem
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Comment |
There was a problem hiding this comment.
Pull request overview
Remediates an SSRF risk in the bulk lookup API by removing loopback network calls that could be influenced by a spoofed Host header, and instead dispatching to the internal lookup route handlers directly.
Changes:
- Replaced internal loopback
fetch()calls in bulk lookup with direct invocation of/api/lookup/{url|doi|isbn}route handlers via synthesizedNextRequest. - Updated bulk lookup tests to mock the imported internal route modules instead of mocking
fetch(). - Added a Sentinel entry documenting the SSRF vulnerability pattern and prevention guidance.
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated 8 comments.
| File | Description |
|---|---|
| src/app/api/lookup/bulk/route.ts | Eliminates loopback network dispatch by directly calling internal lookup route handlers. |
| src/app/api/lookup/bulk/route.test.ts | Switches tests from fetch mocking to module-level route handler mocks for the new dispatch approach. |
| .jules/sentinel.md | Documents the SSRF finding and the preferred mitigation pattern for internal route-to-route calls. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment on lines
+61
to
+68
| // Invoke the route handler directly to prevent SSRF | ||
| const mockRequest = new NextRequest(routeUrl, { | ||
| method: "POST", | ||
| headers: { "Content-Type": "application/json" }, | ||
| body: JSON.stringify(body), | ||
| }); | ||
|
|
||
| const response = await routeHandler(mockRequest); |
Comment on lines
+42
to
+52
| routeHandler = lookupUrlPost; | ||
| body = { url: trimmedItem }; | ||
| routeUrl = "http://localhost/api/lookup/url"; | ||
| } else if (trimmedItem.match(/^10\.\d{4,}/)) { | ||
| apiEndpoint = "/api/lookup/doi"; | ||
| routeHandler = lookupDoiPost; | ||
| body = { doi: trimmedItem }; | ||
| routeUrl = "http://localhost/api/lookup/doi"; | ||
| } else if (trimmedItem.match(/^(97[89])?\d{9}[\dXx]$/)) { | ||
| apiEndpoint = "/api/lookup/isbn"; | ||
| routeHandler = lookupIsbnPost; | ||
| body = { isbn: trimmedItem }; | ||
| routeUrl = "http://localhost/api/lookup/isbn"; |
Comment on lines
4
to
6
|
|
||
| global.fetch = vi.fn(); | ||
|
|
Comment on lines
+7
to
+15
| vi.mock('@/app/api/lookup/url/route', () => ({ | ||
| POST: vi.fn(async (req) => { | ||
| const data = await req.json(); | ||
| if (data.url === 'https://example.com' || data.url === 'https://url-test.com') { | ||
| return new Response(JSON.stringify({ data: { title: data.url === 'https://example.com' ? 'Example Page' : 'URL result' } }), { status: 200 }); | ||
| } | ||
| return new Response(JSON.stringify({ error: 'Not found' }), { status: 404 }); | ||
| }) | ||
| })); |
Comment on lines
+17
to
+25
| vi.mock('@/app/api/lookup/doi/route', () => ({ | ||
| POST: vi.fn(async (req) => { | ||
| const data = await req.json(); | ||
| if (data.doi === '10.1000/xyz123' || data.doi === '10.1234/test') { | ||
| return new Response(JSON.stringify({ data: { title: 'DOI result' } }), { status: 200 }); | ||
| } | ||
| return new Response(JSON.stringify({ error: 'Not found' }), { status: 404 }); | ||
| }) | ||
| })); |
Comment on lines
+27
to
+35
| vi.mock('@/app/api/lookup/isbn/route', () => ({ | ||
| POST: vi.fn(async (req) => { | ||
| const data = await req.json(); | ||
| if (data.isbn === '9780316769174') { | ||
| return new Response(JSON.stringify({ data: { title: 'ISBN result' } }), { status: 200 }); | ||
| } | ||
| return new Response(JSON.stringify({ error: 'Not found' }), { status: 404 }); | ||
| }) | ||
| })); |
Comment on lines
86
to
91
| it('routes URLs to /api/lookup/url', async () => { | ||
| (global.fetch as ReturnType<typeof vi.fn>).mockResolvedValueOnce({ | ||
| ok: true, | ||
| json: async () => ({ data: { title: 'Example Page' } }), | ||
| }); | ||
| const response = await POST(makeRequest({ items: ['https://example.com'] })); | ||
| const data = await response.json(); | ||
| expect(data.results[0].success).toBe(true); | ||
| expect(data.results[0].data.title).toBe('Example Page'); | ||
| const [url] = (global.fetch as ReturnType<typeof vi.fn>).mock.calls[0] as [string]; | ||
| expect(url).toContain('/api/lookup/url'); | ||
| }); |
Comment on lines
+9
to
+12
| ## 2025-02-28 - [SSRF via loopback fetch using user-controlled Host header] | ||
| **Vulnerability:** The bulk lookup API (`src/app/api/lookup/bulk/route.ts`) performed loopback HTTP requests to other internal endpoints using `fetch()` and dynamically derived the host via `request.nextUrl.origin`. Because `request.nextUrl.origin` relies on the HTTP `Host` header, an attacker could spoof it, redirecting the internal `fetch()` to an arbitrary external server or internal IP (a Server-Side Request Forgery vulnerability). | ||
| **Learning:** Next.js Route Handlers (API endpoints) run on the server side and should not invoke each other via network `fetch()` unless absolutely necessary. When doing so with a user-provided or dynamically derived URL based on request headers, it immediately creates an SSRF risk. | ||
| **Prevention:** Rather than using `fetch()` to call internal API endpoints, import their exported `POST`, `GET`, etc., functions directly and invoke them with a synthesized or properly formatted `NextRequest`. This prevents DNS/network routing vulnerabilities and is also more performant. |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
🧹 Nitpick comments (1)
src/app/api/lookup/bulk/route.test.ts (1)
5-5: ⚡ Quick winRemove unused
global.fetchmock.Since the implementation no longer uses
fetch()(replaced with direct handler invocation), this mock is dead code.🧹 Proposed cleanup
-global.fetch = vi.fn(); - vi.mock('`@/app/api/lookup/url/route`', () => ({🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@src/app/api/lookup/bulk/route.test.ts` at line 5, Remove the now-unused global.fetch mock in the test: delete the line that sets global.fetch = vi.fn() from route.test.ts (the top-level test setup), since tests call the handler directly and no code under test uses fetch; this removes dead test setup and avoids misleading mocks.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In `@src/app/api/lookup/bulk/route.test.ts`:
- Line 5: Remove the now-unused global.fetch mock in the test: delete the line
that sets global.fetch = vi.fn() from route.test.ts (the top-level test setup),
since tests call the handler directly and no code under test uses fetch; this
removes dead test setup and avoids misleading mocks.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: 430241ad-ff83-4b55-bce2-5fd5cc418b69
📒 Files selected for processing (3)
.jules/sentinel.mdsrc/app/api/lookup/bulk/route.test.tssrc/app/api/lookup/bulk/route.ts
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Severity: HIGH
Vulnerability: Server-Side Request Forgery (SSRF) via dynamically derived loopback URLs
Impact: An attacker could spoof the HTTP
Hostheader to redirect the internalfetchcall to malicious external endpoints or private internal IPs.Fix: Updated the API endpoint to directly import and invoke the required
POSTroute handlers using a simulatedNextRequestobject instead of routing them over the network viafetch.Verification: Verified against testing suite (run
pnpm test) and unit tests now mock the internal endpoints appropriately.PR created automatically by Jules for task 16062685776947422308 started by @aicoder2009
Summary by CodeRabbit
Bug Fixes
Documentation