GHSA-8v6v-g4rh-jmcm: op_fetch_url validated the initial URL through
validate_fetch_url, but reqwest auto-followed up to 10 redirects with
no further checks. An attacker-allowed origin could 302 to
http://127.0.0.1 (or any private/internal address) and read the body
back to page JS. Real-world impact: AWS instance metadata, kube
debug consoles, internal admin endpoints with permissive CORS all
become readable from a page hosted anywhere on the open web.
Disable reqwest's auto-redirect and follow manually. Apply
validate_fetch_url to every redirect target before requesting it.
Cap the chain at 10 hops to match prior behaviour. Browser-standard
method/body rules apply on cross-method redirects (301/302/303
downgrade to GET with no body, 307/308 preserve).
Verified vs unpatched build (pr69):
- Patched: attacker-page -> 302 -> http://127.0.0.1:N is blocked
with "Redirect to forbidden URL blocked: Access to private IP..."
before the internal hop runs. Legitimate 3-hop redirect chain
between allowed origins still completes.
- Unpatched: internal-service body leaks through to page JS via
fetch().then(r => r.text()).
SGavrl
e371e942fc