[paynejd]

Summary

Hardening: API requests only go to the API host.

• overrideURL accepts a path starting with exactly one /, or an absolute URL on the API's own origin. Anything else is refused.
• sendRequest and request send a token-bearing request only if the final URL's origin equals the API origin. A refusal returns a rejected promise (Refused a request outside the OCL API), never a synchronous throw, and no axios call is made.
• Token-less requests (headers false, as the FHIR operations drawer uses for external FHIR servers) are unaffected.

Testing

The repo has no unit tests. I ran a throwaway Node script (not committed) against the transpiled APIService.js with a mocked axios. It covered: relative path sent; absolute same-origin sent; other-host absolute, no leading slash, // prefix, backslash and undefined all refused with no axios call; token-less external request still sent; token to an external URL blocked. Lint: eslint --ext .jsx,.js src/ (the PR check's command) is clean.

Related: OpenConceptLab/ocl_online#554

🤖 Generated with Claude Code

https://claude.ai/code/session_01VVCCrTucXFfAwXL8jNgbYB

[paynejd]

Review, pass 1 (Codex, commit a8bee31): two minor findings. The token-origin check should match the Authorization header in any letter case, and it should resolve a request's axios baseURL before comparing origins. Both are being fixed in this PR.

[paynejd]

Review, pass 2 (Codex, commit eda542e): three minor findings. Some header layouts aren't seen by the check, and the previous commit dropped a baseURL path prefix and a relative API_URL's subdirectory. The next commit moves the check to the point where axios has its final URL and headers, and stops rewriting the URL.

[paynejd]

Review, pass 3 (Codex, commit fad9cf5): clean. The earlier findings are resolved. The check now runs where axios has its final URL and headers. A simplification pass and a final adversarial check follow.

[paynejd]

Simplification pass and check (commit 57bdcc2): four small cuts were applied, and a Codex check of them came back clean. A final adversarial check follows.

[paynejd]

Review loop complete (head 0f337ef). Codex passes 1–3 and the follow-up checks are clean, and the adversarial check's in-scope items are fixed. The final fix restores concept paths that contain spaces. Ready to merge.