From d485c12fbdeed83562b1755e446639de921a3b99 Mon Sep 17 00:00:00 2001 From: Lakhan Samani Date: Fri, 24 Jul 2026 20:16:23 +0530 Subject: [PATCH] security(e2e): warn at startup when --env=e2e is set --env takes free text with no validation, and E2EEnv silently disables SSRF protection for the SSO broker and webhook registration/delivery, and routes OAuth/SMS to fixed e2e-playground mock addresses. The old per-feature flags (--test-allow-private-sso-hosts, etc.) were self-documenting as dangerous by name; a bare --env=e2e is not, and could be copy-pasted from docker-compose.yml into a real deployment with zero runtime signal. Match the existing AllowedOrigins wildcard warning's pattern. --- cmd/root.go | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/cmd/root.go b/cmd/root.go index 78837d5a..14a53450 100644 --- a/cmd/root.go +++ b/cmd/root.go @@ -421,6 +421,16 @@ func runRoot(c *cobra.Command, args []string) { } } + // Warn if --env=e2e is set — this relaxes SSRF protection (private/loopback-IP + // rejection) for the per-org SSO broker and webhook registration/delivery, and + // routes social-login OAuth and SMS sending to fixed e2e-playground mock + // addresses. It exists solely for e2e-playground/docker-compose.yml and must + // never be set on a real deployment; unlike production/staging, there is no + // other visible symptom if it is (see internal/constants/env.go's E2EEnv doc). + if rootArgs.config.Env == constants.E2EEnv { + log.Warn().Msg("running with --env=e2e: SSRF protection is relaxed for the SSO broker and webhooks, and OAuth/SMS are routed to e2e-playground mock addresses. This must never be set in a real deployment.") + } + // Initialize prometheus metrics metrics.Init()