Epic: Critical Security Updates Q2/3 2026

## Overview

Tracking all active security vulnerabilities flagged by CodeQL static analysis and CVE databases.

> **Status as of 2026-04-14:** None of the Java vulnerabilities have been merged to `main`. PR #723 addresses Alert #5 only and is approved but not yet merged. The epic now reflects corrected priority order after full code review.

## Priority Order

| Priority | Alert | Severity | File | Description | Status |
|---|---|---|---|---|---|
| 1 | #1018 | 🔴 error | `http-task/.../HttpTask.java:175` | **SSRF** — user-controlled URI with no host restrictions; design-level fix needed | ⏳ Open |
| 2 | #6 | 🔴 error | `core/.../ParametersUtils.java:235` | **ReDoS** — catastrophically complex regex runs on every task parameter string | ⏳ Open |
| 3 | #4 | 🟡 warning | `core/.../DummyPayloadStorage.java:95` | **Path injection** — unvalidated path in `new File(payloadDir, path)`; dev-mode only | ⏳ Open |
| 4 | #5 | 🟡 warning | `test-harness/.../MockExternalPayloadStorage.java:96` | **Path injection** — same pattern in test utils; fix in PR #723 (approved) | 🔍 PR #723 |
| 5 | #3 | 🟡 warning | `postgres-persistence/.../PostgresIndexQueryBuilder.java:69` | **ReDoS** — O(n²) regex, short inputs in practice; also compiled per-call not static | ⏳ Open |

## Analysis Notes

### Alert #2 — SSRF in HttpTask *(see #1018)*
The HTTP task is by design intended to call external URLs, but has no guards against reaching internal infrastructure (RFC 1918, loopback, cloud metadata endpoints like `169.254.169.254`). Requires a configurable allowlist/denylist — not a simple patch. Tracked separately in #1018.

### Alert #6 — ReDoS in ParametersUtils *(production risk)*
Nested lookaheads with backreferences and `.*?` quantifiers inside them, applied to every string-valued task parameter during workflow execution. Task output from an external worker flows into the next task's input parameters — a crafted string from a worker could trigger O(n²) to exponential backtracking. Real risk in externally-facing deployments. Needs the complex `PATTERN` regex replaced with a stack-based or simpler iterative parser.

### Alert #4 — Path injection in DummyPayloadStorage *(low, dev-mode only)*
Only active when no external payload storage (S3, GCS, etc.) is configured. `getLocation()` appends a UUID to the path, making traversal unlikely in practice. Still needs a canonical path check for correctness.

### Alert #5 — Path injection in MockExternalPayloadStorage *(very low)*
`getLocation()` returns just `UUID.randomUUID() + ".json"` — ignores the `path` argument — so paths are always UUID-based. Gated by `@ConditionalOnProperty`. PR #723 is approved; just needs merging.

### Alert #3 — ReDoS in PostgresIndexQueryBuilder *(low / borderline false positive)*
Regex `([a-zA-Z]+)\\s?(=|>|<|IN)\\s?(.*)` can be O(n²) for long all-alpha strings with no operator due to backtracking on `[a-zA-Z]+`. Query strings are short in practice. Secondary issue: `Pattern` is compiled inside the constructor on every call instead of being a static field.

## CodeQL Alerts — GitHub Actions (workflow permissions)

| Alert | File | Status |
|---|---|---|
| #14, #17, #29 | `.github/workflows/ci.yml` | ⏳ Missing `permissions` blocks on multiple jobs |
| #24 | `.github/workflows/debug-docker-credentials.yml` | ⏳ Missing `permissions` block |

## CodeQL Alerts — JavaScript

| Alert | File | Description | Status |
|---|---|---|---|
| #23 | `ui-next/.../helpers.ts:194` | Identity replacement (no-op string replace) | ⏳ Open |

## CVE Dependencies

| Issue | Package | Vulnerability | Status |
|---|---|---|---|
| #643 | `ws@7.5.8` (ui/) | CVE-2024-37890 — DoS via excess headers | ⏳ Open |

## Legend
- ✅ Merged/Completed
- 🔍 Ready for review (needs human approval/merge)
- 🔄 In progress
- ⏳ Open (work not yet started)
- ☑️ Closed/Superseded

This is an umbrella issue covering Java, JavaScript, GitHub Actions, and PostgreSQL-related alerts rather than one entry point. Start by selecting a specific open alert, then read the named file such as HttpTask.java, ParametersUtils.java, or the listed workflow and helper files. Done requires resolving that alert with appropriate tests or validation; PR #723 already covers Alert #5.

Written by the indexing model from the issue text.