## 2026-05-15 - [SSRF Bypass Mitigation]
**Vulnerability:** Magic DNS services (e.g., xip.io, nip.io, vcap.me, localtest.me) resolve to internal/loopback IPs.
**Learning:** The application possessed a blocklist for Bogon domains and IP spaces, but `xip.io`, `vcap.me`, and `localtest.me` were omitted from the explicit string checks on the HTTP URI hostnames. This allowed an attacker to bypass the initial string-based topology filter if they crafted a URL like `http://127.0.0.1.xip.io`.
**Prevention:** Add `xip.io`, `vcap.me`, and `localtest.me` (both exact and `.endswith()` suffix checks) to the host quarantine blocklist to enforce zero-trust bounds against SSRF.
## 2024-05-24 - [Critical] Fix Arbitrary Code Execution bypass in DynamicLayoutManifest
**Vulnerability:** A vulnerability in `DynamicLayoutManifest.validate_tstring` allowed Arbitrary Code Execution (ACE) via template string injection. `ast.parse(v, mode="exec")` would throw a `SyntaxError` for strings containing braces (like `}os.system('id'){`), causing the validation to silently `pass`. If the string was later evaluated as an f-string, the malicious payload would execute.
**Learning:** `ast.parse` in `exec` mode is insufficient for validating template strings that will be interpolated later, as syntax errors can hide malicious embedded expressions.
**Prevention:** Always validate template strings by also wrapping them in an f-string structure (e.g., `f"f'''{v_escaped}'''"`) and parsing with `mode="eval"` to ensure embedded expressions are traversed and validated by the AST visitor.
## 2026-05-18 - [Critical] Fix XSS Bypass in InsightCardProfile
**Vulnerability:** A vulnerability in `InsightCardProfile._prevent_malicious_uri_schemes` allowed Cross-Site Scripting (XSS) via markdown execution injection. The HTML decoding logic using `html.unescape` failed to properly catch malformed/missing-semicolon HTML entities (e.g. `&#x3Aalert(1)`) and URL encoded schemas (e.g. `javascript%3Aalert(1)`), which would be successfully rendered by the browser and bypass the quarantine.
**Learning:** Checking for malicious links solely relying on `html.unescape` is insufficient as attackers can obfuscate the executable link schema through URL encoding or incomplete HTML entities, tricking the simple regex logic.
**Prevention:** Always comprehensively decode URL encodings first, followed by normalizing malformed HTML entities with regex (e.g. matching for `&#x3a;?` and `&#0*58;?`), and decoding HTML entities. Only then run the sanitized string against the malicious scheme regex check.
