{"record":{"id":"cffec89b6788d652","repo":"decolua/9router","slug":"invalid-region","errorCode":null,"errorMessage":"Invalid region","messagePattern":"Invalid region","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/lib/oauth/constants/oauth.js","lineNumber":73,"sourceCode":"  return { ideType: 9, platform: getOAuthPlatformEnum(), pluginType: 2 };\n}\n\n// OpenAI OAuth Configuration (Authorization Code Flow with PKCE)\nexport const OPENAI_CONFIG = { ...PROVIDER_OAUTH[\"openai\"] };\n\n// GitHub Copilot OAuth Configuration (Device Code Flow)\nexport const GITHUB_CONFIG = { ...PROVIDER_OAUTH[\"github\"] };\n\n// Kiro OAuth Configuration (multi-method: AWS Builder ID / IDC / Social / Import Token)\nexport const KIRO_CONFIG = { ...PROVIDER_OAUTH[\"kiro\"] };\n\n// AWS region allowlist pattern — prevents SSRF via region injection into upstream URLs (GHSA-6mwv-4mrm-5p3m)\nexport const AWS_REGION_PATTERN = /^[a-z]{2}-[a-z]+-\\d{1,2}$/;\n\n// Reject any region that is not a valid AWS region before interpolating it into a URL\nexport function assertValidAwsRegion(region) {\n  if (typeof region !== \"string\" || !AWS_REGION_PATTERN.test(region)) {\n    throw new Error(\"Invalid region\");\n  }\n  return region;\n}\n\n// Cursor OAuth Configuration (Import Token from Cursor IDE)\n// tokenStoragePaths: user-reference only, not stored in registry\nexport const CURSOR_CONFIG = {\n  ...PROVIDER_OAUTH[\"cursor\"],\n  tokenStoragePaths: {\n    linux: \"~/.config/Cursor/User/globalStorage/state.vscdb\",\n    macos: \"/Users/<user>/Library/Application Support/Cursor/User/globalStorage/state.vscdb\",\n    windows: \"%APPDATA%\\\\Cursor\\\\User\\\\globalStorage\\\\state.vscdb\",\n  },\n};\n\n// Kimi Code OAuth (Device Code Flow) — merged into provider id `kimi` (dual auth)\n// clientId: registry first, env override for forks\nexport const KIMI_CONFIG = {","sourceCodeStart":55,"sourceCodeEnd":91,"githubUrl":"https://github.com/decolua/9router/blob/90b52e06ffd666b7929554211474d01588f6b1f8/src/lib/oauth/constants/oauth.js#L55-L91","documentation":"assertValidAwsRegion validates a region string against AWS_REGION_PATTERN before it is interpolated into upstream AWS/Kiro URLs. This is an SSRF guard (GHSA-6mwv-4mrm-5p3m): a region like `us-east-1/../../evil` or containing scheme characters must never reach URL construction.","triggerScenarios":"Any of kiro, registerClient, startDeviceAuthorization, pollDeviceToken, refreshToken, or listAvailableProfiles receiving a region that is not a string matching ^[a-z]{2}-[a-z]+-\\d{1,2}$ — e.g. undefined region, \"us-east-1 \" with whitespace, uppercase \"US-EAST-1\", or a region field polluted with path/URL fragments.","commonSituations":"Kiro OAuth account imported with an empty or malformed region field in its stored credentials; hand-edited config using uppercase or an alias like \"us-east1\" (missing hyphen); passing the whole endpoint URL instead of just the region.","solutions":["Set a correct lowercase AWS region on the Kiro account/credentials, e.g. \"us-east-1\".","Trim/normalize input: pass region.trim().toLowerCase() before use.","Open the stored Kiro account in the dashboard and fix the region field, or re-import the account with a valid region.","If the region comes from an env/config variable, verify it is set and shaped like e.g. eu-central-1 (2-letter country, name, 1-2 digit)."],"exampleFix":"// before\nawait refreshToken(account, { region: account.Region || undefined });\n// after\nconst region = (account.Region || \"us-east-1\").trim().toLowerCase();\nassertValidAwsRegion(region); // throws early with a clear message if invalid\nawait refreshToken(account, { region });","handlingStrategy":"validation","validationCode":"const AWS_REGION_PATTERN = /^[a-z]{2}-[a-z]+-\\d{1,2}$/;\nfunction regionIsSafe(region) {\n  return typeof region === \"string\" && AWS_REGION_PATTERN.test(region.trim());\n}\nif (!regionIsSafe(account.region)) throw new Error(\"Kiro account has an invalid AWS region\");","typeGuard":"function isValidAwsRegion(x) {\n  return typeof x === \"string\" && /^[a-z]{2}-[a-z]+-\\d{1,2}$/.test(x);\n}","tryCatchPattern":"try {\n  await refreshToken(account, { region });\n} catch (err) {\n  if (err.message === \"Invalid region\") {\n    throw new Error(`Kiro account region \"${region}\" is not a valid AWS region — fix it in account settings`);\n  }\n  throw err;\n}","preventionTips":["Store regions lowercase like us-east-1; never pass endpoint URLs or env blobs into the region field.","Trim and lowercase user-supplied regions before saving them on the account.","Run assertValidAwsRegion at config-save time so bad regions never reach token refresh.","When importing Kiro accounts, verify the region field is populated after import."],"tags":["oauth","ssrf","validation","aws"],"backgroundTag":"invalid-aws-region","analyzedSha":"90b52e06ffd666b7929554211474d01588f6b1f8","analyzedAt":"2026-08-30T21:05:45.952Z","schemaVersion":2},"datasetVersion":"2026-08-30T23:17:21.991Z"}