Severity
High — session-token exfiltration path.
What happens
rawCall documents "Absolute URL (https://…) → used as-is" and attaches Authorization: Bearer <sid>; it is exposed via SF_API_REQUEST and the API Explorer path field. A pasted or social-engineered URL sends the session token off-Salesforce (the request fires even if CORS blocks the response). Related: queryMore builds ${instanceUrl}${payload.nextRecordsUrl} unvalidated.
Evidence
src/services/salesforce/api-client.ts:281-301src/background/index.ts:451
Suggested fix
Reject absolute URLs whose origin ≠ the org's instanceUrl (or a Salesforce-domain allowlist); validate nextRecordsUrl is a relative Salesforce path.
Environment
Commit 74cf21b (main), WaveLink 0.6.0. Found in the 2026-08-31 adversarial audit (code-verified). Note: also contradicts docs/SECURITY.md "Network requests outside Salesforce domains: None".
Severity
High — session-token exfiltration path.
What happens
rawCalldocuments "Absolute URL (https://…) → used as-is" and attachesAuthorization: Bearer <sid>; it is exposed viaSF_API_REQUESTand the API Explorer path field. A pasted or social-engineered URL sends the session token off-Salesforce (the request fires even if CORS blocks the response). Related:queryMorebuilds${instanceUrl}${payload.nextRecordsUrl}unvalidated.Evidence
src/services/salesforce/api-client.ts:281-301src/background/index.ts:451Suggested fix
Reject absolute URLs whose origin ≠ the org's
instanceUrl(or a Salesforce-domain allowlist); validatenextRecordsUrlis a relative Salesforce path.Environment
Commit
74cf21b(main), WaveLink 0.6.0. Found in the 2026-08-31 adversarial audit (code-verified). Note: also contradictsdocs/SECURITY.md"Network requests outside Salesforce domains: None".