During a codebase security audit, two minor issues were identified:
1. SSRF (Server-Side Request Forgery) via IPv6 in Remote Theme Installer
- File:
lib/core/theme/theme_remote_install_policy.dart (isAllowedUrl)
- Details: While private/link-local IPv4 ranges (10.x.x.x, 172.16.x.x, 192.168.x.x, 169.254.x.x) and
::1 are correctly blocked when downloading remote themes, link-local or Unique Local Address (ULA) IPv6 ranges (e.g. fe80::/10, fc00::/7) are not checked. An attacker could request a theme from a private IPv6 address, scanning the local network.
- Fix: Update
isAllowedUrl to parse and filter private/link-local IPv6 ranges.
2. Manual SQL Escaping in MySQL Metadata Queries
- File:
lib/core/database/mysql_connection.dart (listViews, listColumnNames, listTables)
- Details: These methods construct SQL queries using string interpolation and a manual
_escapeSqlString helper instead of parameterized execution, which is always preferred.
- Fix: Use parameterized queries (
params map in execute) instead of manual string escaping.
During a codebase security audit, two minor issues were identified:
1. SSRF (Server-Side Request Forgery) via IPv6 in Remote Theme Installer
lib/core/theme/theme_remote_install_policy.dart(isAllowedUrl)::1are correctly blocked when downloading remote themes, link-local or Unique Local Address (ULA) IPv6 ranges (e.g.fe80::/10,fc00::/7) are not checked. An attacker could request a theme from a private IPv6 address, scanning the local network.isAllowedUrlto parse and filter private/link-local IPv6 ranges.2. Manual SQL Escaping in MySQL Metadata Queries
lib/core/database/mysql_connection.dart(listViews,listColumnNames,listTables)_escapeSqlStringhelper instead of parameterized execution, which is always preferred.paramsmap inexecute) instead of manual string escaping.