From 10978dd834a1cdd9b588bd22ad20344fcbf4f549 Mon Sep 17 00:00:00 2001 From: "google-labs-jules[bot]" <161369871+google-labs-jules[bot]@users.noreply.github.com> Date: Sat, 22 Aug 2026 00:45:18 +0000 Subject: [PATCH] Fix API key exposure in extension/background/service-worker.js This commit addresses a security vulnerability where the API key for the LLM API was being passed as a query string parameter (`key=${apiKey}`) in the `fetch` request URL. This exposure was risky because URLs are routinely logged by intermediate proxies, server logs, and browser history, potentially compromising sensitive credentials. The fix resolves the issue by removing the `key` parameter from the URL and securely passing the API key via the `x-goog-api-key` HTTP header in the `fetch` options. Existing functionality and parsing behavior are preserved. Tested locally by executing the extension and integration test suites. Co-authored-by: savvides <1580637+savvides@users.noreply.github.com> --- extension/background/service-worker.js | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/extension/background/service-worker.js b/extension/background/service-worker.js index ddede63..a20f1a5 100644 --- a/extension/background/service-worker.js +++ b/extension/background/service-worker.js @@ -9,10 +9,13 @@ if (typeof chrome !== 'undefined' && chrome.sidePanel && chrome.sidePanel.setPan } async function callLlmApi(apiKey, prompt) { - const url = `https://generativelanguage.googleapis.com/v1beta/models/gemini-2.5-flash:generateContent?key=${apiKey}`; // IDSTACK_CLI_LEAK_ALLOW + const url = `https://generativelanguage.googleapis.com/v1beta/models/gemini-2.5-flash:generateContent`; // IDSTACK_CLI_LEAK_ALLOW const response = await fetch(url, { method: 'POST', - headers: { 'Content-Type': 'application/json' }, + headers: { + 'Content-Type': 'application/json', + 'x-goog-api-key': apiKey + }, body: JSON.stringify({ contents: [{ parts: [{ text: prompt }] }], generationConfig: {