Forge Permission Screen Fails to Mention External Sites

Forge
1

Hello.

I’ve noticed that Forge’s permission screen gets external permissions wrong?!.

The app has this permission descriptor:

permissions:
  scopes:
    - 'read:confluence-user'
    - 'storage:app'
  content:
    styles:
      - 'unsafe-inline'
    scripts:
      - 'unsafe-inline'
  external:
    fetch:
      backend:
        - '*'

However, on the permission screen, I get this set of permissions asked:

image
image1322×1528 146 KB

It says 0 external sites. Zero! The pure opposite on what the app actually does.

Am I understanding the permission screen wrong?

Update: I’ve created a bug [FRGE-816] - Ecosystem Jira.
Unless I’m missing something, this is imo quite a bad security bug. Because the app has more permissions that a customers things it has.

5 Likes
2

Hi Roman, thanks for raising. That definitely doesn’t look right. We’ll look into it.

3

We’ve identified the problem and will get this fixed as a priority. Thanks for raising FRGE-816, we’ll keep it updated with progress.

1 Like
4

Hi Roman, thanks again for raising. This issue has now been resolved and the consent screen displays correctly.

Screen Shot 2022-09-19 at 5.26.40 PM

In future, it would be great if could raise any security issues directly via a ticket or the bug bounty program so they can be addressed even sooner.

1 Like
5

I’m encountering a similar issue myself where egress urls are not been added to the app consent screen External fetch URLs not showing on consent screen and fails to allow access