The /api/devfile/ and /api/devfile/samples/ endpoints in the OpenShift console (bridge) are registered with handleFunc() directly, without being wrapped in authHandler or authHandlerWithUser like every other /api/ route (pkg/server/server.go:347-348).

DevfileHandler decodes an arbitrary JSON body and passes DevfileContent to devfile.ParseDevfileAndValidate(parser.ParserArgs{Data: ..., HTTPTimeout: &httpTimeout}). The devfile library resolves parent.uri, kubernetes.uri, and remote plugin references over HTTP from the console pod. No request-body size limit is applied (MaxBytesReader is absent).

An unauthenticated attacker on the OpenShift Route can send a crafted devfile payload with parent.uri pointing to internal services (e.g. cloud metadata endpoints, etcd, kubelets). The response body is reflected in the parser error string returned to the client, yielding partial-read SSRF. Repeated large-body POSTs without Content-Length cause unbounded memory growth (DoS).

Tested and reproduced on OCP 5.0 nightly cluster.

Upstream: https://github.com/openshift/console File: pkg/server/server.go:347-348, pkg/devfile/handler.go:37-67