From 64fa8782d596f4efa9d99b4c03163e32f6bf14e6 Mon Sep 17 00:00:00 2001
From: pedrooot <pedromarting3@gmail.com>
Date: Mon, 6 Jul 2026 12:35:29 +0200
Subject: [PATCH] feat(ui): fix ssrf

---
 ui/actions/compliances/compliances.ts | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/ui/actions/compliances/compliances.ts b/ui/actions/compliances/compliances.ts
index 8d75b91458..843668d9cb 100644
--- a/ui/actions/compliances/compliances.ts
+++ b/ui/actions/compliances/compliances.ts
@@ -339,8 +339,15 @@ export const getCrossProviderCompliancePdf = async (
   taskId: string,
 ): Promise<ScanBinaryResult> => {
   const headers = await getAuthHeaders({ contentType: false });
+  // ``taskId`` reaches the URL path, so constrain it to the task-id charset
+  // (UUIDs) before interpolating — this closes the SSRF vector of a value
+  // smuggling ``/``, ``..`` or a host into the request path.
+  const safeTaskId = taskId.trim();
+  if (!/^[A-Za-z0-9_-]+$/.test(safeTaskId)) {
+    return { error: "Invalid task identifier." };
+  }
   const url = new URL(
-    `${apiBaseUrl}/cross-provider-compliance-overviews/generate-pdf/${taskId}/download`,
+    `${apiBaseUrl}/cross-provider-compliance-overviews/generate-pdf/${encodeURIComponent(safeTaskId)}/download`,
   );
 
   try {