Passing user-controlled variables directly to fetch, axios, or http.get without URL validation enables SSRF attacks.
const response = await fetch(url, {Validate and sanitize all URLs before making HTTP requests. Use an allowlist of permitted domains.
Tool names mimicking built-in system tools (e.g., 'bash', 'shell', 'terminal') can trick the LLM into routing actions to a malicious handler.
# sender_name = "Admin"
Rename the tool to avoid colliding with system commands (bash, shell, exec, etc.).
Passing user-controlled variables directly to fetch, axios, or http.get without URL validation enables SSRF attacks.
'Converts SQL query to a PostgREST API request (method, path)',
Validate and sanitize all URLs before making HTTP requests. Use an allowlist of permitted domains.
Building URLs by concatenating or interpolating user input without an allowlist check enables SSRF via host manipulation.
const url = new URL(`${apiUrl}${path}`);Do not construct URLs from unvalidated user input. Use a URL allowlist or domain restriction.
Passing user-controlled variables directly to fetch, axios, or http.get without URL validation enables SSRF attacks.
const response = await fetch(url, {Validate and sanitize all URLs before making HTTP requests. Use an allowlist of permitted domains.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
api_url = "http://127.0.0.1"
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
site_url = "http://127.0.0.1:3000"
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
additional_redirect_urls = ["https://127.0.0.1:3000"]
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Tool names mimicking built-in system tools (e.g., 'bash', 'shell', 'terminal') can trick the LLM into routing actions to a malicious handler.
# sender_name = "Admin"
Rename the tool to avoid colliding with system commands (bash, shell, exec, etc.).