From 10993b0df9c36cbee973c95cee71aa2877d70175 Mon Sep 17 00:00:00 2001
From: Elliot Scribner <ejscribner@gmail.com>
Date: Wed, 30 Sep 2026 08:38:42 -0700
Subject: [PATCH 1/3] Potential fix for code scanning alert no. 9: Workflow
 does not contain permissions

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
---
 .github/workflows/cb-service-container.yml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.github/workflows/cb-service-container.yml b/.github/workflows/cb-service-container.yml
index 9a379ba..e3fa7ea 100644
--- a/.github/workflows/cb-service-container.yml
+++ b/.github/workflows/cb-service-container.yml
@@ -9,6 +9,8 @@ on:
       - main
   schedule:
     - cron: "0 11 * * 0"
+permissions:
+  contents: read
 jobs:
   tests:
     runs-on: ubuntu-latest

From bee05829cdf22a937b859a6747570ae22ec44bbb Mon Sep 17 00:00:00 2001
From: Elliot Scribner <ejscribner@gmail.com>
Date: Wed, 30 Sep 2026 08:38:55 -0700
Subject: [PATCH 2/3] Potential fix for code scanning alert no. 4: Server-side
 request forgery

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
---
 pages/index.js | 11 ++++-------
 1 file changed, 4 insertions(+), 7 deletions(-)

diff --git a/pages/index.js b/pages/index.js
index b4ca1c9..bf87eb4 100644
--- a/pages/index.js
+++ b/pages/index.js
@@ -10,7 +10,7 @@ import { validateEmail } from '../util/helpers/validateEmail';
 import Image from 'next/image';
 import Notification from '../components/Notification';
 
-export default function Home({ origin }) {
+export default function Home() {
   const [selectedProfile, setSelectedProfile] = useState(undefined);
   const [userProfiles, setUserProfiles] = useState([]);
   const [isProfilesLoading, setIsProfilesLoading] = useState(true);
@@ -38,7 +38,7 @@ export default function Home({ origin }) {
   useEffect(() => {
     const fetchAllProfiles = () => {
       fetch(
-        `${origin}/api/user${
+        `/api/user${
           searchString ? `?search=${searchString}&limit=200` : '?limit=200'
         }`,
         {
@@ -79,7 +79,7 @@ export default function Home({ origin }) {
         });
     };
     fetchAllProfiles();
-  }, [searchString, origin]);
+  }, [searchString]);
 
   const openCreateModal = () => {
     setIsCreateModalOpen(true);
@@ -317,9 +317,6 @@ export default function Home({ origin }) {
 export async function getServerSideProps(context) {
   const { req } = context;
 
-  const protocol = req.headers['x-forwarded-proto'] || 'http';
-  const origin = req ? `${protocol}://${req.headers.host}` : '';
-
   let connection = await connectToDatabase();
 
   const { profileCollection } = connection;
@@ -338,6 +335,6 @@ export async function getServerSideProps(context) {
   }
 
   return {
-    props: { isConnected, origin },
+    props: { isConnected },
   };
 }

From d1f87aac482dc0920eb069ea93705159e56e7697 Mon Sep 17 00:00:00 2001
From: dex-the-ai <dex-the-ai@users.noreply.github.com>
Date: Wed, 30 Sep 2026 15:51:13 +0000
Subject: [PATCH 3/3] fix: resolve remaining SSRF code scanning alerts (#5, #6,
 #7)

Use same-origin relative URLs for the create, delete, and update profile
requests instead of the request-derived origin, URL-encode user-supplied
query values (search, pid), and drop the now-unused `req` destructuring in
getServerSideProps so lint passes.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 pages/index.js | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/pages/index.js b/pages/index.js
index bf87eb4..b946b60 100644
--- a/pages/index.js
+++ b/pages/index.js
@@ -39,7 +39,9 @@ export default function Home() {
     const fetchAllProfiles = () => {
       fetch(
         `/api/user${
-          searchString ? `?search=${searchString}&limit=200` : '?limit=200'
+          searchString
+            ? `?search=${encodeURIComponent(searchString)}&limit=200`
+            : '?limit=200'
         }`,
         {
           method: 'GET',
@@ -94,7 +96,7 @@ export default function Home() {
     setLastName(undefined);
     setEmail(undefined);
 
-    fetch(`${origin}/api/user`, {
+    fetch(`/api/user`, {
       method: 'POST',
       body: JSON.stringify({
         firstName: firstName,
@@ -137,7 +139,7 @@ export default function Home() {
    * @return {Promise<void>}
    */
   const handleProfileDeletion = (pid) => {
-    fetch(`${origin}/api/user?pid=${pid}`, { method: 'DELETE' })
+    fetch(`/api/user?pid=${encodeURIComponent(pid)}`, { method: 'DELETE' })
       .then((response) => {
         if (response.status === 401) {
           setIsReadonlyNotificationOpen(true);
@@ -168,7 +170,7 @@ export default function Home() {
    * @param pid
    */
   const handleProfileEdit = (pid) => {
-    fetch(`${origin}/api/user?pid=${pid}`, {
+    fetch(`/api/user?pid=${encodeURIComponent(pid)}`, {
       method: 'PUT',
       body: JSON.stringify({
         firstName: updatedFirstName && updatedFirstName,
@@ -314,9 +316,7 @@ export default function Home() {
   );
 }
 
-export async function getServerSideProps(context) {
-  const { req } = context;
-
+export async function getServerSideProps() {
   let connection = await connectToDatabase();
 
   const { profileCollection } = connection;