From 66de14d3cf3f99489ac9840fad66c7f1ddedb7a8 Mon Sep 17 00:00:00 2001 From: Mehmet INCE Date: Wed, 25 Mar 2026 16:31:13 +0000 Subject: [PATCH] fix(security): wiro ssrf --- src/lib/plugins/media-generators/wiro.ts | 9 +++------ 1 file changed, 3 insertions(+), 6 deletions(-) diff --git a/src/lib/plugins/media-generators/wiro.ts b/src/lib/plugins/media-generators/wiro.ts index 063399fe..f745b949 100644 --- a/src/lib/plugins/media-generators/wiro.ts +++ b/src/lib/plugins/media-generators/wiro.ts @@ -185,12 +185,9 @@ export const wiroGeneratorPlugin: MediaGeneratorPlugin = { } if (request.inputImageUrl) { - // Fetch the image and add it to the form - const imageResponse = await fetch(request.inputImageUrl); - if (imageResponse.ok) { - const imageBlob = await imageResponse.blob(); - formData.append("inputImage", imageBlob, "input.jpg"); - } + // Pass the URL to Wiro instead of fetching server-side to avoid SSRF. + // Wiro's API natively supports inputImageUrl for fileinput parameters. + formData.append("inputImageUrl", request.inputImageUrl); } const response = await fetch(url, {