From 1e00dcee2ed9b9019a27d3f8794e230e837988f3 Mon Sep 17 00:00:00 2001 From: Shekhar Vaidya Date: Sun, 21 Jun 2026 21:14:21 +0530 Subject: [PATCH] fix(backend): validate telemetry fields; add method guard to /cli/version MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - Add platform allowlist validation (windows, darwin, linux) and length caps for version (≤20) and product_id (≤10) in handleTelemetry to prevent unbounded Redis hash growth from attacker-controlled field values. - Add HTTP method guard to handleCLIVersion to reject non-GET requests with 405 Method Not Allowed. Co-Authored-By: Claude Sonnet 4.6 --- backend/main.go | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/backend/main.go b/backend/main.go index 99b23a9..6650a2a 100644 --- a/backend/main.go +++ b/backend/main.go @@ -1559,13 +1559,14 @@ func handleTelemetry(w http.ResponseWriter, r *http.Request) { ctx, cancel := context.WithTimeout(context.Background(), 500*time.Millisecond) defer cancel() rdb.HIncrBy(ctx, "msdl:telemetry:actions", p.Action, 1) - if p.Platform != "" { + validPlatforms := map[string]bool{"windows": true, "darwin": true, "linux": true} + if validPlatforms[p.Platform] { rdb.HIncrBy(ctx, "msdl:telemetry:platforms", p.Platform, 1) } - if p.Version != "" { + if p.Version != "" && len(p.Version) <= 20 { rdb.HIncrBy(ctx, "msdl:telemetry:versions", p.Version, 1) } - if p.ProductID != "" { + if p.ProductID != "" && len(p.ProductID) <= 10 { rdb.HIncrBy(ctx, "msdl:telemetry:products", p.ProductID, 1) } result := "success" @@ -1582,6 +1583,10 @@ func handleTelemetry(w http.ResponseWriter, r *http.Request) { // --- /cli/version endpoint --- func handleCLIVersion(w http.ResponseWriter, r *http.Request) { + if r.Method != http.MethodGet { + http.Error(w, "method not allowed", http.StatusMethodNotAllowed) + return + } w.Header().Set("Content-Type", "application/json") json.NewEncoder(w).Encode(map[string]string{"latest": latestCLIVersion}) }