{"record":{"id":"20ad93abe746654e","repo":"diegosouzapw/OmniRoute","slug":"invalid-region","errorCode":null,"errorMessage":"Invalid region","messagePattern":"Invalid region","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/lib/oauth/constants/oauth.ts","lineNumber":325,"sourceCode":"  tokenUrl: GITLAB_DUO_ENDPOINTS.tokenUrl,\n  userInfoUrl: GITLAB_DUO_ENDPOINTS.userUrl,\n  directAccessUrl: GITLAB_DUO_ENDPOINTS.directAccessUrl,\n  scope: \"ai_features read_user\",\n  codeChallengeMethod: \"S256\",\n};\n\n// AWS region allowlist — prevents SSRF via region injection into upstream URLs\n// (GHSA-6mwv-4mrm-5p3m). Region values flow user-supplied through the kiro OAuth\n// import surfaces (request body, providerSpecificData) and are interpolated into\n// URLs like `https://oidc.${region}.amazonaws.com/...`. Without this guard, a\n// region like \"127.0.0.1\" or \"evil.com\" would redirect the proxy's outbound\n// fetch to an attacker-controlled host. Canonical AWS region shape only:\n// two letters, dash, one-or-more letters, dash, one-or-two digits.\nexport const AWS_REGION_PATTERN = /^[a-z]{2}-[a-z]+-\\d{1,2}$/;\n\nexport function assertValidAwsRegion(region: string): string {\n  if (typeof region !== \"string\" || !AWS_REGION_PATTERN.test(region)) {\n    throw new Error(\"Invalid region\");\n  }\n  return region;\n}\n\n// Kiro OAuth Configuration\n// Supports multiple auth methods:\n// 1. AWS Builder ID (Device Code Flow)\n// 2. AWS IAM Identity Center/IDC (Device Code Flow with custom startUrl/region)\n// 3. Google/GitHub Social Login (Authorization Code Flow - manual callback)\n// 4. Import Token (paste refresh token from Kiro IDE)\nexport const KIRO_CONFIG = {\n  // AWS SSO OIDC endpoints for Builder ID/IDC (Device Code Flow)\n  ssoOidcEndpoint: \"https://oidc.us-east-1.amazonaws.com\",\n  registerClientUrl: \"https://oidc.us-east-1.amazonaws.com/client/register\",\n  deviceAuthUrl: \"https://oidc.us-east-1.amazonaws.com/device_authorization\",\n  tokenUrl: \"https://oidc.us-east-1.amazonaws.com/token\",\n  // AWS Builder ID default start URL\n  startUrl: \"https://view.awsapps.com/start\",","sourceCodeStart":307,"sourceCodeEnd":343,"githubUrl":"https://github.com/diegosouzapw/OmniRoute/blob/a179ffed5bb2e0b883b9ae7214ce8717b2a94c4d/src/lib/oauth/constants/oauth.ts#L307-L343","documentation":"Error \"Invalid region\" thrown in diegosouzapw/OmniRoute.","triggerScenarios":"Thrown at src/lib/oauth/constants/oauth.ts:325 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":[],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"a179ffed5bb2e0b883b9ae7214ce8717b2a94c4d","analyzedAt":"2026-08-25T18:35:09.898Z","schemaVersion":2},"datasetVersion":"2026-08-25T21:54:21.419Z"}