[Security] REST explorer rawCall attaches the Bearer token to arbitrary absolute URLs #65

Severity

High — session-token exfiltration path.

What happens

rawCall documents "Absolute URL (https://…) → used as-is" and attaches Authorization: Bearer <sid>; it is exposed via SF_API_REQUEST and the API Explorer path field. A pasted or social-engineered URL sends the session token off-Salesforce (the request fires even if CORS blocks the response). Related: queryMore builds ${instanceUrl}${payload.nextRecordsUrl} unvalidated.

Evidence

• src/services/salesforce/api-client.ts:281-301
• src/background/index.ts:451

Suggested fix

Reject absolute URLs whose origin ≠ the org's instanceUrl (or a Salesforce-domain allowlist); validate nextRecordsUrl is a relative Salesforce path.

Environment

Commit 74cf21b (main), WaveLink 0.6.0. Found in the 2026-08-31 adversarial audit (code-verified). Note: also contradicts docs/SECURITY.md "Network requests outside Salesforce domains: None".