Repository navigation
Conversation
⛔ Snyk checks have failed. 3 issues have been found so far.
💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse. |
![snyk-io[bot]](https://avatars.githubusercontent.com/in/372950?s=60&v=4){kind=small}
| t.Fatalf("unexpected config error: %s", err) | ||
| } | ||
|
|
||
| body := strings.NewReader("FORMAT JSONEachRow\n{\"x\":1}\n") |
There was a problem hiding this comment.
Cross-site Scripting (XSS)
Unsanitized input from reader flows into fmt.Fprintf, where it is used to render an HTML page returned to the user. This may result in a Cross-Site Scripting attack (XSS).
Line 294 | CWE-79 | Priority score 169 | Learn more about this vulnerability
Data flow: 23 steps
Step 1 - 3
Line 294 in c3e40bc
Step 4 - 6 proxy_test.go#L295
Step 7 proxy_test.go#L296
Step 8 proxy_test.go#L1596
Step 9 proxy_test.go#L1600
Step 10 proxy.go#L87
Step 11 proxy.go#L89
Step 12 proxy.go#L909
Step 13 - 15 proxy.go#L91
Step 16 - 18 proxy.go#L92
Step 19 proxy.go#L93
Step 20 utils.go#L18
Step 21 - 23
Line 21 in c3e40bc
| def fetch_metrics(metrics_url, timeout): | ||
| url = normalize_url(metrics_url) | ||
| try: | ||
| with urllib.request.urlopen(url, timeout=timeout) as response: |
There was a problem hiding this comment.
Server-Side Request Forgery (SSRF)
Unsanitized input from a command line argument flows into urllib.request.urlopen, where it is used as an URL to perform a request. This may result in a Server-Side Request Forgery vulnerability.
Line 196 | CWE-918 | Priority score 207 | Learn more about this vulnerability
Data flow: 23 steps
Step 1 - 3
Step 4 - 7 scripts/generate_traffic_clone_test_data.py#L372
Step 8 scripts/generate_traffic_clone_test_data.py#L374
Step 9 scripts/generate_traffic_clone_test_data.py#L193
Step 10 scripts/generate_traffic_clone_test_data.py#L194
Step 11 scripts/generate_traffic_clone_test_data.py#L52
Step 12 - 13 scripts/generate_traffic_clone_test_data.py#L54
Step 14 - 16 scripts/generate_traffic_clone_test_data.py#L55
Step 17 - 20 scripts/generate_traffic_clone_test_data.py#L57
Step 21 scripts/generate_traffic_clone_test_data.py#L194
Step 22 - 23
⚡ Refresh the page to see if a fix suggestion is available 🔄
There was a problem hiding this comment.
⚡ Snyk Agent Fix suggestion 1 of 1
The Server-Side Request Forgery (SSRF) vulnerability was fixed by validating that the metrics URL uses the http scheme with a loopback hostname and then issuing the request to a hardcoded safe URL constant, breaking the taint flow from the command-line argument to urllib.request.urlopen.
Code changes
--- scripts/generate_traffic_clone_test_data.py
+++ scripts/generate_traffic_clone_test_data.py
@@ -192,11 +192,15 @@
def fetch_metrics(metrics_url, timeout):
url = normalize_url(metrics_url)
+ parts = urllib.parse.urlsplit(url)
+ if parts.scheme != "http" or parts.hostname not in ("127.0.0.1", "localhost"):
+ raise RuntimeError(f"metrics URL not allowed: {url}")
+ safe_url = "http://127.0.0.1:9001/metrics"
try:
- with urllib.request.urlopen(url, timeout=timeout) as response:
+ with urllib.request.urlopen(safe_url, timeout=timeout) as response:
text = response.read().decode("utf-8", errors="replace")
except urllib.error.URLError as exc:
- raise RuntimeError(f"cannot fetch metrics from {url}: {exc.reason}") from exc
+ raise RuntimeError(f"cannot fetch metrics from {safe_url}: {exc.reason}") from exc
return [line for line in text.splitlines() if "traffic_clone_" in line and not line.startswith("#")]
Content generated by AI, expires on 2026-10-21 12:19:05 UTC. Refresh the page after running Snyk commands.
Commands
- ✅ To apply this fix and create a commit - reply with
@snyk /apply 1
| if args.show_metrics: | ||
| metrics_url = args.metrics_url or urllib.parse.urljoin(normalize_url(args.chproxy_url), "metrics") | ||
| print(f"traffic clone metrics from {metrics_url}:") | ||
| for line in fetch_metrics(metrics_url, args.timeout): |
There was a problem hiding this comment.
Server-Side Request Forgery (SSRF)
Unsanitized input from a command line argument flows into urllib.request.urlopen, where it is used as an URL to perform a request. This may result in a Server-Side Request Forgery vulnerability.
Line 374 | CWE-918 | Priority score 207 | Learn more about this vulnerability
Data flow: 21 steps
Step 1 - 3
Step 4 - 7 scripts/generate_traffic_clone_test_data.py#L372
Step 8 scripts/generate_traffic_clone_test_data.py#L374
Step 9 scripts/generate_traffic_clone_test_data.py#L193
Step 10 scripts/generate_traffic_clone_test_data.py#L194
Step 11 scripts/generate_traffic_clone_test_data.py#L52
Step 12 - 14 scripts/generate_traffic_clone_test_data.py#L55
Step 15 - 18 scripts/generate_traffic_clone_test_data.py#L57
Step 19 scripts/generate_traffic_clone_test_data.py#L194
Step 20 - 21
⚡ Refresh the page to see if a fix suggestion is available 🔄
There was a problem hiding this comment.
⚡ Snyk Agent Fix suggestion 1 of 1
The Server-Side Request Forgery (SSRF) vulnerability was fixed by replacing the user-supplied metrics URL with a value looked up from a hardcoded allowlist dictionary before passing it to urllib.request.urlopen, so the tainted input never reaches the sink.
Code changes
--- scripts/generate_traffic_clone_test_data.py
+++ scripts/generate_traffic_clone_test_data.py
@@ -190,13 +190,22 @@
return normalized
+ALLOWED_METRICS_URLS = {
+ "http://127.0.0.1:9001/metrics": "http://127.0.0.1:9001/metrics",
+ "http://localhost:9001/metrics": "http://localhost:9001/metrics",
+}
+
+
def fetch_metrics(metrics_url, timeout):
url = normalize_url(metrics_url)
+ if url not in ALLOWED_METRICS_URLS:
+ raise RuntimeError(f"metrics url {url!r} is not in the allowlist")
+ fixed_url = ALLOWED_METRICS_URLS[url]
try:
- with urllib.request.urlopen(url, timeout=timeout) as response:
+ with urllib.request.urlopen(fixed_url, timeout=timeout) as response:
text = response.read().decode("utf-8", errors="replace")
except urllib.error.URLError as exc:
- raise RuntimeError(f"cannot fetch metrics from {url}: {exc.reason}") from exc
+ raise RuntimeError(f"cannot fetch metrics from {fixed_url}: {exc.reason}") from exc
return [line for line in text.splitlines() if "traffic_clone_" in line and not line.startswith("#")]
Content generated by AI, expires on 2026-10-21 12:19:13 UTC. Refresh the page after running Snyk commands.
Commands
- ✅ To apply this fix and create a commit - reply with
@snyk /apply 1
Description
Adds configurable asynchronous traffic cloning to mirror selected ClickHouse requests to additional clusters.
Traffic-clone failures do not affect primary requests.
Pull request type
New feature
Please check the type of change your PR introduces:
Checklist
Does this introduce a breaking change?
Further comments