- Shipped
- September 23, 2026 at 2:18 AM UTC
- Author
- Kamo
- Commit
- 71c6d27
k8s/Docs-deployment.yaml's aliasgroup1 was 'https://api\..*'. Docs's alias matcher (RegexUtil::getValue, std::regex_match) requires only that the WHOLE candidate authority match the WHOLE pattern, and '.*' absorbs whatever follows "api." — so this trusted literally any domain on the internet shaped https://api.<anything>, as long as its owner put an "api." label in front. Docs's WSD process is the one that dereferences an alias-matched WOPI host server-side, so a trusted alias is SSRF exposure, not a redundant check sitting on top of the signed WOPI JWT (the comment removed here said the JWT was "the real gate" — it narrows WHICH document/member a request acts as, per the WopiController fix earlier in this branch, but never gated WHICH HOST Docs would treat as a legitimate WOPI storage endpoint). Replaced with the actual live tenant hosts: api.kamocrm.com and any subdomain of it (kamocrm.com is Kamo's own domain — nobody outside Kamo can create a name ending in it, so this half stays correct as new *.kamocrm.com orgs are added, with no redeploy — it is what covers api.demo.kamocrm.com-style per-org demo hosts today), union'd with the org_domains rows that are root (parent_id IS NULL), active, ownership_verified AND ssl_confirmed as of 2026-09-22 — the same three conditions OrgApiHosts.verifiedRootDomain already gates OAuth callback hosts on: b11capital.com, breakbeat.store, chinilaw.com, harmonyhomeloans.net, kamo.club, makeitpopsigns.com, optionone.com, sign.pink, tech-life.com. New test: DocsAliasHostTest, reading the deployed YAML value as text (same convention as **************** and compiling it with java.util.regex, whose Matcher#matches has the same whole-string semantics as std::regex_match. Mutation-checked: reverting to 'https://api\..*' turns 3 of its 6 cases red (arbitrary attacker domain, a lookalike domain that merely contains "kamocrm" as a substring, and a trailing-suffix trick past a known host). NOT A FULL FIX, reported as a known gap: a wholly new custom domain (not a *.kamocrm.com subdomain) going live still needs a line added here and a redeploy — the same limitation the old per-domain aliasgroup1..N list had, and the reason it was replaced with the wildcard in the first place (Docs-fork commit b5d260a24e, "Per-domain aliasgroup1..N list only trusted 4 tenants; new tenants like api.optionone.com got 'unauthorized WOPI host'"). A durable fix needs either Docs's remote_config fetch pointed at a live, DB-backed endpoint, or an automation that regenerates this manifest and rolls Docs whenever an org_domains row newly satisfies **************** — infra work, not folded into this change. Also noted for the coordinator: org_domains has a row for domain='localhost' owned by KamoCRM Inc. itself, active+verified+ssl_confirmed, which looks like leftover dev/seed data rather than a real tenant domain; left untouched (out of scope for this fix, and changing org_domains data needs the manual DDL path) but worth a look. Full suite: 731 tests green (was 725; +6 new).