fix: fix security issue in assets.py

[anupamme]

Summary

Fix high severity security issue in admin/qadmin/assets.py.

Vulnerability

Field	Value
ID	V-001
Severity	HIGH
Scanner	multi_agent_ai
Rule	V-001
File	admin/qadmin/assets.py:256
Assessment	Likely exploitable

Description: The _fetch function accepts arbitrary URLs and makes HTTP requests without validating the target. URLs are derived from lvlworld map metadata or EXTRA_PAKS environment variable without validation, allowing attackers to force the server to make requests to internal resources including cloud metadata endpoints.

Evidence

Exploitation scenario: Attacker sets EXTRA_PAKS environment variable to 'http://169.254.169.254/latest/meta-data/iam/security-credentials/' or manipulates lvlworld content to inject malicious URLs.

Scanner confirmation: multi_agent_ai rule V-001 flagged this pattern.

Production code: This file is in the production codebase, not test-only code.

Threat Model Context

This is a containerized service - vulnerabilities may be exploitable depending on network exposure.

Changes

• admin/qadmin/assets.py

Behavior Preservation

The change is scoped to 1 file on the vulnerable path.

Security Invariant

Property: The security boundary is maintained under adversarial input

Regression test

import pytest
from unittest.mock import patch, MagicMock
from admin.qadmin.assets import _fetch


@pytest.mark.parametrize("url", [
    "http://169.254.169.254/latest/meta-data/",  # AWS metadata endpoint (SSRF target)
    "http://metadata.google.internal/computeMetadata/v1/",  # GCP metadata endpoint
    "http://10.0.0.1/internal-admin",  # Internal network resource
    "http://example.com/valid-asset.pk3",  # Valid external URL
])
def test_fetch_rejects_internal_and_metadata_urls(url):
    """Invariant: _fetch must block requests to internal/metadata endpoints to prevent SSRF."""
    with patch('urllib.request.build_opener') as mock_opener:
        mock_opener.return_value.open.side_effect = Exception("Request should not reach network")
        
        with pytest.raises(ValueError, match="blocked|forbidden|internal|metadata|SSRF"):
            _fetch(url)

This test guards against regressions — it's useful independent of the code change above.

---

Automated security fix by OrbisAI Security