SSRF and Path Traversal via Server-Controlled Failure Bundle Metadata

[OkeyAmy]

Summary

testsprite test failure get downloads a failure bundle. The server response (CliFailureContext) contains four URL fields the CLI fetches with no host validation. A malicious API server (or a poisoned api_url in ~/.testsprite/credentials) sets these to internal addresses. The CLI etches them from the developer's machine and writes the response to the bundle on disk.

writeStepArtifacts() in bundle.ts constructs filenames using two server-controlled fields — evidence[].kind and step.stepIndex — without sanitizing them first. path.join() normalizes embedded ../ sequences, placing downloaded files outside the bundle output directory. An attacker writes arbitrary files to the developer's home directory or system paths.

Details:

Four unguarded download sinks

src/lib/bundle.ts:453   result.videoUrl        → video.mp4
src/lib/bundle.ts:608   step.screenshotUrl     → <N>-screenshot.png
src/lib/bundle.ts:614   step.htmlSnapshotUrl   → <N>-snapshot.html
src/lib/bundle.ts:664   evidence[].url         → <N>-<kind>-<i>.<ext>
src/lib/bundle.ts:708   streamUrlToFile()      ← no guard here either

assertNotLocal() exists in src/lib/target-url.ts and works correctly. It is wired to --target-url validation only. It is not called before any download sink.

No size cap or timeout on downloads

No Content-Length check, no AbortSignal, no byte cap. Malicious server streams infinite bytes → CLI hangs

--endpoint-url accepts any host including localhost/RFC1918

Validation only checks http(s) scheme. http://localhost:9999, http://169.254.169.254, and http://192.168.1.1 all pass.

evidence[].kind interpolated into path

// src/lib/bundle.ts:662-664
const ext = sidecarExtension(entry.kind);          // kind used unsanitized
const filename = `${prefix}-${entry.kind}-${i}.${ext}`;
await streamUrlToFile(entry.url, join(stepsTmpDir, filename), fetchImpl);
//                                ^^^^^^^^^^^^^^^^^^^^^^^^^^^
//                                path.join resolves ../ sequences

entry.kind is typed 'log' | 'network' | 'console' | 'screenshot' | 'snapshot' at compile time. At runtime, a malicious API sends any string — the type is not enforced.

step.stepIndex interpolated into path without runtime numeric check

// src/lib/bundle.ts:604
const prefix = stepFilenamePrefix(step.stepIndex);

// src/lib/bundle.ts (stepFilenamePrefix)
function stepFilenamePrefix(idx: number): string {
  return String(idx).padStart(2, '0');  // no isInteger / isFinite check
}

Edit:
Discord:okey_amy

[zeshi-du]

Fixed by #60 (merged 2026-07-05): artifact downloads now run with redirect: 'error' so a redirect can never bypass the https-only validation, and presigned URLs are stripped of query/signature in every error message and error-details payload. Closing as completed — thanks for the careful report.