Skip to content

fix: add output encoding in Create.php#11882

Open
orbisai0security wants to merge 10000 commits intoappwrite:devfrom
orbisai0security:fix-v-003-src-appwrite-platform-modules-databases-http-databases-collections-attributes-url-c5cc8b7e
Open

fix: add output encoding in Create.php#11882
orbisai0security wants to merge 10000 commits intoappwrite:devfrom
orbisai0security:fix-v-003-src-appwrite-platform-modules-databases-http-databases-collections-attributes-url-c5cc8b7e

Conversation

@orbisai0security
Copy link
Copy Markdown

Summary

Fix high severity security issue in src/Appwrite/Platform/Modules/Databases/Http/Databases/Collections/Attributes/URL/Create.php.

Vulnerability

Field Value
ID V-003
Severity HIGH
Scanner multi_agent_ai
Rule V-003
File src/Appwrite/Platform/Modules/Databases/Http/Databases/Collections/Attributes/URL/Create.php:46
CWE CWE-79

Description: The URL attribute Create and Update endpoints in the Databases module accept URL values stored as collection attributes. If URL values are not strictly validated to permit only http and https schemes, attackers with write access can store javascript: protocol URLs or data: URIs. When these values are later retrieved and rendered in a frontend application without proper output encoding (e.g., as an href or src attribute), they can trigger stored cross-site scripting (XSS) or server-side request forgery (SSRF) attacks. Confidence is low pending manual review of the full validation middleware chain.

Changes

  • app/init/database/formats.php
  • src/Appwrite/Platform/Modules/Databases/Http/Databases/Collections/Attributes/URL/Create.php
  • src/Appwrite/Platform/Modules/Databases/Http/Databases/Collections/Attributes/URL/Update.php

Verification

  • Build passes
  • Scanner re-scan confirms fix
  • LLM code review passed

Automated security fix by OrbisAI Security

ChiragAgg5k and others added 30 commits April 2, 2026 17:25
Updated the README to enhance clarity and remove outdated information.
Updated the description of Appwrite to emphasize its open-source nature and capabilities. Added detailed product descriptions for Appwrite services.
Reduced the ENQUEUE_TIMER constant from 60 seconds to 30 seconds. Modified the condition for currentTick to use less than or equal to (<=) instead of less than (<) for better accuracy in scheduling. Changed return statement to continue in case of missing schedule key to enhance flow control.
…ec-docs

[codex] Fail specs when referenced docs are missing
…gration-flake

[codex] Fix flaky VectorsDB metadata bootstrap in migrations
Meldiron and others added 30 commits April 11, 2026 11:16
Wrap only cache load/save calls in try-catch instead of the entire
cache block. This prevents OrderException, QueryException, and Timeout
from $find() being caught and retried, which would double DB calls and
hide real query errors.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
…loyment-resource-type-optional

Make rule deploymentResourceType optional for non-deployment rules
…1876)

Http::execute() now requires a Response parameter as of utopia-php/http
0.34.20. The GraphQL resolver was only passing route and request,
causing all GraphQL queries to fail with "Internal server error".

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
utopia-php/http 0.34.20 added a guard that skips the action if
$response->isSent() is true. In batched GraphQL requests the resolver
reuses a single Response across all queries — after the first query's
action calls send(), subsequent queries hit the guard, their actions
are skipped, and stale/null payloads are returned.

Add Response::clearSent() to the Appwrite Response subclass (which can
access the protected $sent property from the parent) and call it in
Resolvers::resolve() before each execute(). This ensures each batched
query gets a fresh sent state while keeping the guard active for normal
request paths.

Also bumps utopia-php/http from 0.34.19 to 0.34.20 so CE CI tests
against the same version used by downstream consumers (cloud).

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
…t-reset

fix: reset response sent state between batched GraphQL queries
…ls-apis

Feat: services protocols public apis
added reset in db worker for queue for realtime
The URL attribute Create and Update endpoints in the Databases module accept URL values stored as collection attributes
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.