fix: enforce representation blob ownership and secure SSR access

actions/services/documentDirectService.js

@@ -28,13 +28,48 @@ export const getAwaitingSubmissionFromBlob = (containerName) => {
     });
 };
 
-export const getRepsFromBlob = (containerName) => {
+export const getRepsFromBlob = (containerName, config) => {
     const route = buildFileQuery("/api/file/getrepsblob", {
         container: containerName
     });
 
+    const url = withBaseUrl(BASE_URL, appendHashSuffix(route, hashAPIPath));
+
+    const hasForwardedCookie =
+        typeof config?.headers?.Cookie === "string" &&
+        config.headers.Cookie.length > 0;
+
+    if (hasForwardedCookie) {
+        let trustedDestination = false;
+
+        try {
+            const destination = new URL(url);
+            const expectedOrigin = new URL(process.env.NEXTAUTH_URL);
+
+            trustedDestination =
+                destination.origin === expectedOrigin.origin &&
+                ["http:", "https:"].includes(destination.protocol) &&
+                !destination.username &&
+                !destination.password;
+        } catch {
+            trustedDestination = false;
+        }
+
+        if (!trustedDestination) {
+            return Promise.reject(
+                new Error("Untrusted representation request destination")
+            );
+        }
+    }
+
     return getFileJson(
-        withBaseUrl(BASE_URL, appendHashSuffix(route, hashAPIPath))
+        url,
+        hasForwardedCookie
+            ? {
+                  ...config,
+                  maxRedirects: 0
+              }
+            : config
     ).catch((error) => {
         consoleLogger(error);
     });