GHSA-8qhj-4f8c-j8qg: GET /api/v1/cron/:id/manual changed shared state
on the agent stream, and the JWT cookie is SameSite=Lax so a victim's
browser would send the cookie on a top-level cross-site GET. An
attacker could trick a logged-in user into firing any of their own
cron commands.
Switch the route to POST: SameSite=Lax cookies are not sent on cross-
site POST, closing the CSRF window without introducing a new token.
Tests:
- TestCronManualTriggerRejectsCrossSiteGET locks in that GET no longer
resolves.
- TestCronManualTriggerAcceptsSameSitePOST locks in the legitimate POST
still works.
Frontend (admin-frontend) updated in a follow-up commit.
Co-authored-by: cloudcode <cloudcode@users.noreply.github.com>
naibaandnaiba/CloudCode
