mirror of
https://github.com/affaan-m/ECC.git
synced 2026-08-17 21:15:40 +02:00
Affaan MustafaandGitHub
382060905e
* fix: harden local data boundaries Bind the capabilities dashboard exclusively to loopback and reject untrusted Host and Origin values. Constrain project-configured agent data paths to the Cursor data root, and harden lifecycle repair/uninstall operations against state-file traversal, symlink swaps, unsafe sources, and forged install-state destinations.\n\nCloses #2506 * fix: eliminate repair source read race Read source bytes and mode from one no-follow file descriptor so a path replacement cannot mix metadata from one inode with content from another. Add a regression that rejects separate path-based source metadata lookup. * fix: close dashboard hardening review gaps
58 lines
1.8 KiB
JavaScript
58 lines
1.8 KiB
JavaScript
'use strict';
|
|
|
|
/**
|
|
* Host/Origin gating for ECC's loopback HTTP servers (control pane, plan
|
|
* canvas). DNS rebinding can point an attacker-controlled hostname at
|
|
* 127.0.0.1, so every request must present a Host header from this
|
|
* allowlist before the server does any work.
|
|
*/
|
|
|
|
const LOOPBACK_HOSTNAMES = new Set(['127.0.0.1', 'localhost', '[::1]', '::1']);
|
|
|
|
// Extract the hostname portion of an HTTP Host header value, stripping any
|
|
// port. Returns null when the header is missing or malformed.
|
|
function parseHostHeader(value) {
|
|
if (!value || typeof value !== 'string') return null;
|
|
const trimmed = value.trim();
|
|
if (!trimmed) return null;
|
|
const match = trimmed.match(/^(\[[^\]]+\]|[^:]+)(?::(\d+))?$/);
|
|
if (!match) return null;
|
|
if (match[2] !== undefined) {
|
|
const port = Number(match[2]);
|
|
if (!Number.isInteger(port) || port > 65535) return null;
|
|
}
|
|
return match[1].toLowerCase();
|
|
}
|
|
|
|
function buildAllowedHostnames(configuredHost) {
|
|
const set = new Set(LOOPBACK_HOSTNAMES);
|
|
if (configuredHost) set.add(String(configuredHost).toLowerCase());
|
|
return set;
|
|
}
|
|
|
|
function isAllowedHostHeader(hostHeader, allowedHostnames) {
|
|
const hostname = parseHostHeader(hostHeader);
|
|
if (!hostname) return false;
|
|
return allowedHostnames.has(hostname);
|
|
}
|
|
|
|
// Origin is absent on same-origin navigations and CLI clients; when present
|
|
// it must resolve to an allowed hostname.
|
|
function isAllowedOrigin(originHeader, allowedHostnames) {
|
|
if (!originHeader || typeof originHeader !== 'string') return true;
|
|
try {
|
|
const url = new URL(originHeader);
|
|
return allowedHostnames.has(url.hostname.toLowerCase());
|
|
} catch {
|
|
return false;
|
|
}
|
|
}
|
|
|
|
module.exports = {
|
|
LOOPBACK_HOSTNAMES,
|
|
buildAllowedHostnames,
|
|
isAllowedHostHeader,
|
|
isAllowedOrigin,
|
|
parseHostHeader
|
|
};
|