Overview - Forgerock

forgerock

7 days30 days

Latest CI Pipeline Executions

Fuzzy

Succeeded
580
168c7237 test(token-vault): remove unnecessary blob URL tests
5 hours ago by ryanbas21
Succeeded
580
d319384f fix(token-vault): replace substring URL matching with strict equality Fixes a security vulnerability where evaluateUrlForInterception used .includes() for URL matching, allowing allow-list bypass via query parameter injection (e.g. https://evil.com?https://valid.com). Replaces .includes() with === for exact string comparison. Blob URLs now require explicit wildcard patterns (blob:https://origin/*). Also removes @forgerock/token-vault from changeset ignore list to enable re-release.
1 day ago by ryanbas21