fix: Server-Side Request Forgery (SSRF) in Instagram auth adapter

[mtrezza]

Fixes security vulnerability GHSA-3f5f-xgrj-97pf

Summary by CodeRabbit

• Bug Fixes

  • Instagram authentication now consistently uses the official Graph API endpoint, preventing potential endpoint misconfigurations.

• Tests

  • Added test coverage for Instagram authentication endpoint handling.

_{✏️ Tip: You can customize this high-level summary in your review settings.}

[parse-github-assistant]

I will reformat the title to use the proper commit message syntax.

[parse-github-assistant]

🚀 Thanks for opening this pull request!

[parseplatformorg]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scanner	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[coderabbitai]

📝 Walkthrough

Walkthrough

The changes hardcode the Instagram Graph API endpoint to https://graph.instagram.com/ in the getUserFromAccessToken method, removing support for client-provided API URL overrides. A new test case verifies this endpoint enforcement behavior.

Changes

Cohort / File(s)	Summary
Instagram Graph API endpoint hardcoding src/Adapters/Auth/instagram.js, spec/Adapters/Auth/instagram.spec.js	Production code changes getUserFromAccessToken to hardcode the Graph API URL instead of accepting configurable overrides via authData.apiURL. Test adds a case validating that client-provided apiURL values are ignored in favor of the fixed endpoint.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

• Verify the hardcoded URL (https://graph.instagram.com/) is the correct official endpoint
• Check for other code paths or tests that may depend on the removed apiURL configurability
• Confirm no breaking changes for existing integrations that previously relied on URL overrides

Pre-merge checks and finishing touches

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	No pull request description was provided; the required template sections including Issue, Approach, and Tasks are entirely missing.	Add a complete PR description following the template: include the issue link under 'Issue', explain the changes under 'Approach', and mark relevant tasks completed under 'Tasks'.

✅ Passed checks (2 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Title check	✅ Passed	The title accurately describes the main security fix in the changeset—hardcoding the Instagram Graph API endpoint to prevent SSRF attacks.

✨ Finishing touches

• 📝 Generate docstrings

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 92.53%. Comparing base (a23b192) to head (dd2038a).
⚠️ Report is 9 commits behind head on alpha.

Additional details and impacted files

@@            Coverage Diff             @@
##            alpha    #9988      +/-   ##
==========================================
- Coverage   92.53%   92.53%   -0.01%     
==========================================
  Files         190      190              
  Lines       15471    15470       -1     
  Branches      176      176              
==========================================
- Hits        14316    14315       -1     
  Misses       1143     1143              
  Partials       12       12              

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[parseplatformorg]

🎉 This change has been released in version 9.1.1-alpha.1

[parseplatformorg]

🎉 This change has been released in version 9.1.1