Server-side URL fetching for assets #14

New issue

Open

opened 2026-08-26 04:49:56 +00:00 by jlxq0 · 0 comments

jlxq0 commented

2026-08-26 04:49:56 +00:00

Owner

Migrated from Plan.md's "Deferred (do not drift into these)" section when that file was retired; open work belongs in issues, not in a file with no state. Nothing here is scheduled and no decision has been taken. Do not start it without an explicit go.

Assets are supplied by the caller and validated in a metadata-only preflight before any bytes are read. Nothing in the request causes the server to make an outbound HTTP request.

Adding URL fetching makes the render path an SSRF surface reachable by any authenticated tenant, pointed at the cluster's internal network. That is a security decision, and it has not been taken.

Migrated from `Plan.md`'s "Deferred (do not drift into these)" section when that file was retired; open work belongs in issues, not in a file with no state. **Nothing here is scheduled and no decision has been taken.** Do not start it without an explicit go. Assets are supplied by the caller and validated in a metadata-only preflight before any bytes are read. Nothing in the request causes the server to make an outbound HTTP request. Adding URL fetching makes the render path an SSRF surface reachable by any authenticated tenant, pointed at the cluster's internal network. **That is a security decision**, and it has not been taken.

jlxq0 added this to the Deferred — needs a decision milestone

2026-08-26 04:49:56 +00:00

jlxq0 added the

deferred

label

2026-08-26 04:49:56 +00:00