mirror/insomnia
1
0
Fork 0
mirror of https://github.com/Kong/insomnia.git synced 2026-08-04 03:42:20 -04:00
Code Issues Packages Projects Releases Wiki Activity

fix: enforce URL validation to disallow local file URIs in curl requests (#8957)

Browse Source
This commit is contained in:
Jack Kavanagh
2026-06-23 19:17:10 +02:00
committed by GitHub
parent 72ef5cf563
commit aef7619b84
2 changed files with 5 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
packages/insomnia/src/main/network/curl.ts
View File

@@ -150,9 +150,9 @@ const openCurlConnection = async (
const caCertificate = caCertficatePath && (await insecureReadFile(caCertficatePath));
try {
if (!options.url) {
throw new Error('URL is required');
}
invariant(options.url, 'URL must be defined');
invariant(!options.url.startsWith('file://'), 'Local file URIs are not supported');
const readyStateChannel = `${protocolName}.${request._id}.${REALTIME_EVENTS_CHANNELS.READY_STATE}`;
const settings = await services.settings.get();

3
packages/insomnia/src/main/network/libcurl-promise.ts
View File

@@ -119,7 +119,8 @@ export const curlRequest = (options: CurlRequestOptions) =>
authHeader,
noDecompress = false,
} = options;
// allow reading the file as the caCert is chosen by user
invariant(!finalUrl.startsWith('file://'), 'Local file URIs are not supported');
const caCert = caCertficatePath && (await insecureReadFile(caCertficatePath));
const { curl, debugTimeline } = createConfiguredCurlInstance({