SSWConsulting / SSWConsulting/SSW.MeetupMCP
Image uploadUrl is not pinned to HTTPS or a Meetup host
Nobody has claimed this yet.
- Dominant language
- TypeScript
- Stars
- 1
- Forks
- 0
- PR merge metrics
- No merged PRs in 30d
Description
Summary
The upload URL returned by the photo-placeholder mutation is validated with z.url() at src/meetup/response-schemas.ts:146, and the server then PUTs local file bytes to whatever came back.
z.url() in Zod 4 accepts far more than intended. Confirmed accepted: file:///etc/passwd, http://localhost:8080/x, http://169.254.169.254/latest/meta-data/, ftp://x/y.
Impact
Low likelihood, since the response arrives over TLS from api.meetup.com and exploiting this requires a compromised Meetup API or TLS interception. Filed because the fix is a one-liner and the consequence is that local file contents get written to an attacker-chosen destination.
Suggested fix
Require the scheme to be https: and the host to end in a known Meetup or storage-provider suffix. Reject anything else with a meetup_api error before the PUT is issued.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start at src/meetup/response-schemas.ts:146 and trace the photo-placeholder mutation through the PUT that sends local file bytes. Confirm the accepted URL scheme and host suffixes, then verify invalid URLs produce a meetup_api error before the PUT is issued.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- typescript
- Domain
- security
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 72/100