fix: add URL validation in package.json

[anupamme]

Summary

Fix high severity security issue in package.json.

Vulnerability

Field	Value
ID	V-003
Severity	HIGH
Scanner	multi_agent_ai
Rule	V-003
File	package.json:1
Assessment	Likely exploitable
CWE	CWE-918

Description: The sync-request library performs synchronous HTTP requests which block the event loop. Malicious servers can delay responses indefinitely causing application hang. The library may not properly validate SSL certificates or handle redirects, enabling SSRF if user-controlled URLs are passed.

Evidence

Exploitation scenario: If application accepts user-provided URLs for fetching content, attacker provides URL to internal service (http://169.254.169.254/latest/meta-data/ for AWS metadata) or a slowloris-style server that.

Scanner confirmation: multi_agent_ai rule V-003 flagged this pattern.

Production code: This file is in the production codebase, not test-only code.

Threat Model Context

This is a Node.js library - vulnerabilities affect downstream consumers who use this package.

Changes

• package.json
• grabData/deviceList.js
• generatePageData/generateFirmware.js
• generatePageData/grabData/device.js

Behavior Preservation

The change is scoped to 4 files on the vulnerable path; it only tightens handling of untrusted input and leaves valid inputs unaffected.

---

Automated security fix by OrbisAI Security