fix(wrapper): block forwarding to the management canister

[AntonioVentilii]

Summary

The bridge's bridge_call only rejected calls whose target was the canister itself:

if args.target == ic_cdk::api::canister_self() {
    return Err("Self-calls are not allowed through the bridge.".to_string());
}

It did not block the IC management canister (aaaaa-aa). Because call0/call_blob are public #[update] entrypoints that forward an arbitrary target/method/raw args, any caller could set target = aaaaa-aa and have the bridge forward a management-canister call (update_settings, install_code, uninstall_code, stop_canister, …).

On the IC, an inter-canister call is authorized as the calling canister's principal, and management-canister methods authorize on whether the caller is a controller of the canister_id in the payload. So a forwarded management call executes with the bridge's own authority — if the bridge is (or becomes) a controller of any canister, an attacker could change controllers, uninstall code, or stop that canister.

Fix

Reject the management canister principal explicitly, alongside the existing self-call guard, via a new BridgeError::ForbiddenTarget variant.

Notes on severity

This is primarily a hardening / defense-in-depth fix. The concrete impact is contingent on the bridge controlling some canister; under a default deployment where the bridge controls nothing, the management canister would reject the forwarded call anyway. Blocking aaaaa-aa at the bridge closes the gap regardless of controller configuration. A longer-term improvement would be moving from a target denylist to an allowlist of permitted (target, method) pairs (the MethodKey/MethodConfig types already anticipate this).

Testing

• cargo build / cargo clippy -p ic-papi-wrapper — clean
• New integration test bridge_call_fails_if_target_is_management_canister passes alongside the existing bridge tests (3 passed).

[zeropath-ai]

✅ No security or compliance issues detected. Reviewed everything up to a317ec6.

Security Overview

• 🔎 Scanned files: 3 changed file(s)
• 🔗 Scan Link: https://zeropath.com/app/repositories/dd8a815d-e064-4aac-acac-9fe387cf999e?scanId=4ba09079-caa9-4846-8195-d1a108686ac5&codeScanTypes=PrScan&tab=issues

Detected Code Changes

Change Type	Relevant files
Enhancement	► src/wrapper/src/api/call.rs     Add MANAGEMENT_CANISTER_ID constant and guard logic to block management canister access through the bridge ► src/wrapper/src/domain/errors.rs     Add ForbiddenTarget error variant and Display handling ► src/wrapper/tests/it/bridge_tests.rs     Add test bridge_call_fails_if_target_is_management_canister to verify protection against management canister access

[Copilot]

Pull request overview

This PR hardens the ic-papi-wrapper bridge entrypoints (call0/call_blob) by preventing them from being used as a proxy to the IC management canister (aaaaa-aa), which would otherwise allow forwarded management-canister calls to execute with the bridge canister’s own authority.

Changes:

• Introduces a BridgeError::ForbiddenTarget error variant for disallowed bridge targets.
• Adds an explicit guard in bridge_call rejecting Principal::management_canister().
• Adds an integration test ensuring bridge calls fail when the target is the management canister.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.

File	Description
src/wrapper/src/api/call.rs	Adds an explicit management-canister target block inside bridge_call.
src/wrapper/src/domain/errors.rs	Adds ForbiddenTarget variant and Display formatting.
src/wrapper/tests/it/bridge_tests.rs	Adds integration test for rejecting management-canister targets.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.