Security: Critical SSRF Vulnerability in getRepoData

[nkar123412-hub]

I have discovered a critical Server-Side Request Forgery (SSRF) vulnerability in the getRepoData function within src/shared/repoData.ts.

Vulnerability:
The function getRepoData handles requestHost and requestUrl to identify the repository. When a requestUrl starting with 'http' is provided, it is used directly to create a new URL object:
fullUrl = new URL(requestUrl);

This allows an attacker to supply any arbitrary URL, causing the server to make requests to internal or external resources that it should not access.

Example:
If an attacker provides requestUrl = 'http://internal-service:8080/admin', the server will perform a request to that internal endpoint.

Impact:

• Exposure of internal network services.
• Potential for further attacks on internal infrastructure.
• Data leakage from internal APIs.

Recommendation:

• Implement a strict allowlist for allowed hosts.
• Validate that the target URL is not pointing to internal IP ranges (RFC 1918) or localhost.
• Sanitize and validate the requestUrl before use.