Skip to content

Restrict /updateTheme to the configured theme file and harden market host verification #1405

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
adilburaksen wants to merge 2 commits into
base: develop
Choose a base branch
from
Open

Restrict /updateTheme to the configured theme file and harden market host verification #1405

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
d71e94f
Restrict /updateTheme to the configured theme file and harden market …
adilburaksen Jun 1, 2026
9fa0f6e
Cache parsed market base URLs to avoid re-parsing per request
adilburaksen Jun 1, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 7 additions & 0 deletions server/express.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -704,6 +704,13 @@ function makeApp(authAddress, cdapConfig, uiSettings) {
if (!uiThemePath) {
return res.status(500).send('UnKnown theme file. Please make sure the path is valid');
}
// Only allow (re)loading the theme file configured by the operator. Without
// this check, extractUITheme() would __non_webpack_require__() an arbitrary
// absolute path taken from the request body, letting a caller load any file
// on the server as a Node module.
if (uiThemePath !== cdapConfig['ui.theme.file']) {
return res.status(400).send('Invalid theme file path');
}
try {
uiThemeConfig = uiThemeWrapper.extractUITheme(cdapConfig, uiThemePath);
} catch (e) {
Expand Down
25 changes: 24 additions & 1 deletion server/url-helper.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -56,7 +56,30 @@ function extractMarketUrls(cdapConfig) {
export const getMarketUrls = memoize(extractMarketUrls);

export function isVerifiedMarketHost(cdapConfig, url) {
return !!getMarketUrls(cdapConfig).find((element) => url.startsWith(element));
// A naive `url.startsWith(element)` lets an attacker bypass the allowlist with
// origins such as `https://market.cdap.io.evil.com/...` or
// `https://market.cdap.io@evil.com/...`, turning the market proxy into an
// SSRF. Parse both URLs and require an exact origin match plus a path that is
// contained within the configured market base path.
let requested;
try {
requested = new URL(url);
} catch (e) {
return false;
}
return !!getMarketUrls(cdapConfig).find((element) => {
let base;
try {
base = new URL(element);
} catch (e) {
return false;
}
if (requested.origin !== base.origin) {
return false;
}
const basePath = base.pathname.endsWith('/') ? base.pathname : `${base.pathname}/`;
return requested.pathname === base.pathname || requested.pathname.startsWith(basePath);
});
Copy link
Copy Markdown

@gemini-code-assist gemini-code-assist Bot Jun 1, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

Parsing the configured market URLs using 'new URL()' on every single request validation is inefficient, especially since 'getMarketUrls(cdapConfig)' is already memoized and the configuration rarely changes. We can optimize this by caching the parsed 'URL' objects using a 'WeakMap' keyed by the 'cdapConfig' object. This avoids repeated parsing overhead while preventing memory leaks and key collisions.

  if (cdapConfig && typeof cdapConfig === 'object') {
    if (!isVerifiedMarketHost.cache) {
      isVerifiedMarketHost.cache = new WeakMap();
    }
    let parsedBases = isVerifiedMarketHost.cache.get(cdapConfig);
    if (!parsedBases) {
      parsedBases = getMarketUrls(cdapConfig)
        .map((element) => {
          try {
            return new URL(element);
          } catch (e) {
            return null;
          }
        })
        .filter(Boolean);
      isVerifiedMarketHost.cache.set(cdapConfig, parsedBases);
    }
    return !!parsedBases.find((base) => {
      if (requested.origin !== base.origin) {
        return false;
      }
      const basePath = base.pathname.endsWith('/') ? base.pathname : base.pathname + '/';
      return requested.pathname === base.pathname || requested.pathname.startsWith(basePath);
    });
  }
  return false;

}

export function constructUrl(cdapConfig, path, origin = REQUEST_ORIGIN_ROUTER) {
Expand Down