Block requests vulnerable to opennext vulnerability#9635
Merged
CarmenPopoviciu merged 1 commit intomainfrom Jun 18, 2025
Merged
Block requests vulnerable to opennext vulnerability#9635CarmenPopoviciu merged 1 commit intomainfrom
CarmenPopoviciu merged 1 commit intomainfrom
Conversation
🦋 Changeset detectedLatest commit: 0a5749a The changes in this PR will be included in the next version bump. This PR includes changesets to release 1 package
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
create-cloudflare
@cloudflare/kv-asset-handler
miniflare
@cloudflare/pages-shared
@cloudflare/unenv-preset
@cloudflare/vite-plugin
@cloudflare/vitest-pool-workers
@cloudflare/workers-editor-shared
wrangler
commit: |
6128ffb to
6bc0688
Compare
Contributor
|
@matthewdavidrodgers could we please get a review from D&C 🙏 ? |
petebacondarwin
approved these changes
Jun 18, 2025
Contributor
petebacondarwin
left a comment
There was a problem hiding this comment.
Let's land this since it is already in production.
6bc0688 to
0a5749a
Compare
Addresses GHSA-rvpw-p7vw-wj3m This has already been applied in production, this commit keeps the repository in sync. Images loaded via the /_next/image?url=<some remote image> were vulnerable to SSRF, and particularly if the user loaded the image in a new tab (instead of forcing the browser to treat it as an image). Thus, if request didn't indicate that the browser was going to treat the resource as an image (via the 'Sec-Fetch-Dest: image' header), we block the request when it doesn't return image content.
0a5749a to
35fc2e6
Compare
Merged
jseba
added a commit
to jseba/workers-sdk
that referenced
this pull request
Jun 18, 2025
…seba/containers_scope * 'main' of ssh://github.com/cloudflare/workers-sdk: (31 commits) Refactor preview mode and ensure compatibility with Vite 7 (cloudflare#9647) Block requests vulnerable to opennext vulnerability (cloudflare#9635) Add test for cloudchamber buildAndMaybePush (cloudflare#9638) chore: remove redundant binding guide superseded by internal docs (cloudflare#9648) add changeset to trigger release of workers/pages projects (cloudflare#9649) Add @handler to Python templates. (cloudflare#9305) Migrate from unbuild to obuild (cloudflare#9243) Version Packages (cloudflare#9650) fix changeset (cloudflare#9651) containers: Default scheduling policy should be the default (cloudflare#9621) Rename Mixed Mode to remote proxy/remote bindings depending on context (cloudflare#9586) Version Packages (cloudflare#9632) Correctly mock out getDockerImageDigest for testing buildAndMaybePush (cloudflare#9636) [C3] Bump create-remix from 2.16.6 to 2.16.8 in /packages/create-cloudflare/src/frameworks (cloudflare#9525) Remove "Cloudchamber" from user facing error messages (cloudflare#9628) sync local containers with latest workerd (cloudflare#9576) Bump the workerd-and-workers-types group with 2 updates (cloudflare#9591) [C3] Bump gatsby from 5.14.3 to 5.14.4 in /packages/create-cloudflare/src/frameworks (cloudflare#9524) [C3] Bump create-react-router from 7.6.1 to 7.6.2 in /packages/create-cloudflare/src/frameworks (cloudflare#9526) [C3] Bump create-docusaurus from 3.8.0 to 3.8.1 in /packages/create-cloudflare/src/frameworks (cloudflare#9527) ...
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Addresses GHSA-rvpw-p7vw-wj3m
This has already been applied in production, this commit keeps the repository in sync.
Images loaded via the /_next/image?url= were vulnerable to SSRF, and particularly if the user loaded the image in a new tab (instead of forcing the browser to treat it as an image). Thus, if request didn't indicate that the browser was going to treat the resource as an image (via the 'Sec-Fetch-Dest: image' header), we block the request when it doesn't return image content.
Fixes WC-3704.