vrr/spawn
2
0
Fork 0
mirror of https://github.com/OpenRouterTeam/spawn.git synced 2026-05-08 18:39:50 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 7

fix(security): validate OAuth code format before file write (#1322)

Browse source 
CRITICAL: Prevent injection via malicious OAuth callback

Vulnerability:
- OAuth code from query param was written directly to file
- Attacker-controlled OAuth provider could inject:
  - Newlines (write multiple files via code="line1\nline2")
  - Control characters to corrupt subsequent parsing
  - Excessively long strings (DoS via disk fill)

Fix:
- Added strict validation: alphanumeric + dash/underscore only
- Length constraint: 16-128 chars (matches real OAuth codes)
- Fail with 400 status if validation fails
- Type coercion (String()) prevents prototype pollution

Impact: HIGH
- Affects: All users running OAuth flow (default auth method)
- Attack vector: Malicious redirect to fake OAuth endpoint
- Severity: Code injection, file system manipulation

Agent: security-auditor

Co-authored-by: spawn-bot <bot@openrouter.ai>
Co-authored-by: Claude Sonnet 4.5 <noreply@anthropic.com>
This commit is contained in:
A 2026-02-16 18:04:43 -08:00 • committed by GitHub
parent 378b2c7d1d
commit 87184ebbf7
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 10 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

11
shared/common.sh
View file

@ -655,7 +655,16 @@ const server = http.createServer((req, res) => {
setTimeout(() => { server.close(); process.exit(1); }, 500);
return;
}
fs.writeFileSync('${code_file}', parsed.query.code);
// SECURITY: Validate OAuth code format before writing to file
// OpenRouter OAuth codes are alphanumeric with hyphens/underscores, typically 32-64 chars
const code = String(parsed.query.code || '');
if (!/^[a-zA-Z0-9_-]{16,128}\$/.test(code)) {
res.writeHead(400, {'Content-Type':'text/html','Connection':'close'});
res.end('<html><body><h1>Invalid OAuth Code</h1><p>The authorization code format is invalid.</p></body></html>');
setTimeout(() => { server.close(); process.exit(1); }, 500);
return;
}
fs.writeFileSync('${code_file}', code);
res.writeHead(200, {'Content-Type':'text/html','Connection':'close'});
res.end(html);
setTimeout(() => { server.close(); process.exit(0); }, 500);