creatixchu 01d68dee4e
fix(connection): fence every /api request behind one browser-trust check ...
The only browser-trust guard covered host.pickDirectory, while the
consequential methods (session.prompt drives bash) accepted any Host —
open to DNS rebinding, where a rebound page reads and writes the API as
if same-origin and only the Host header betrays the attacker's domain.
The pickDirectory-specific loopback guard becomes a prefix-wide fence:
Host must be loopback or an exact host[:port] from the new trustedHosts
config, an attached Origin must equal that authority, and explicit
cross-site markers are refused; requests without browser markers (curl,
tests, native clients) pass, because without a browser there is no
confused deputy. The loopback-socket check is dropped — binding policy
expresses reachability, and the fence is not an auth layer. The Agent
Note records the full threat model and the alternatives.
2026-07-28 14:56:45 +08:00
2026-07-26 23:06:00 +08:00
2026-07-26 23:06:00 +08:00
2026-07-26 23:06:00 +08:00
2026-07-28 00:00:51 +08:00
2026-07-28 00:00:51 +08:00
2026-07-28 00:00:51 +08:00
2026-07-24 13:57:16 +08:00
2026-07-22 23:07:14 +08:00
2026-07-24 13:57:16 +08:00
2026-07-23 00:10:53 +08:00
2026-07-22 23:07:14 +08:00
2026-07-23 00:10:53 +08:00
2026-07-23 19:48:00 +08:00
2026-07-23 19:33:30 +08:00
2026-07-23 19:48:00 +08:00
2026-07-24 13:57:16 +08:00
2026-07-22 23:07:14 +08:00
2026-07-24 13:57:16 +08:00
2026-07-24 13:57:16 +08:00
2026-07-22 23:07:14 +08:00
2026-07-24 13:57:16 +08:00
2026-07-26 22:45:33 +08:00
2026-07-26 22:45:33 +08:00
2026-07-26 22:45:33 +08:00
2026-07-26 23:44:52 +08:00
2026-07-26 23:44:52 +08:00
2026-07-26 23:44:52 +08:00
2026-07-23 00:10:53 +08:00
2026-07-22 23:07:14 +08:00
2026-07-23 00:10:53 +08:00
2026-07-26 23:06:00 +08:00
2026-07-26 23:06:00 +08:00
2026-07-26 23:06:00 +08:00
2026-07-25 01:58:42 +08:00
2026-07-24 23:43:10 +08:00
2026-07-25 01:58:42 +08:00
2026-07-24 13:57:16 +08:00
2026-07-23 00:10:53 +08:00
2026-07-24 13:57:16 +08:00
2026-07-25 15:11:17 +08:00
2026-07-25 15:11:17 +08:00
2026-07-25 15:11:17 +08:00
2026-07-25 01:58:42 +08:00
2026-07-24 23:43:10 +08:00
2026-07-25 01:58:42 +08:00
2026-07-26 05:35:04 +08:00
2026-07-26 05:13:39 +08:00
2026-07-26 05:35:04 +08:00
2026-07-27 23:29:26 +08:00
2026-07-27 23:29:26 +08:00
2026-07-27 23:29:26 +08:00
2026-07-23 01:11:59 +08:00
2026-07-22 23:07:14 +08:00
2026-07-23 01:11:59 +08:00
2026-07-26 23:06:00 +08:00
2026-07-26 23:06:00 +08:00
2026-07-26 23:06:00 +08:00
2026-07-24 18:38:27 +08:00
2026-07-22 23:07:14 +08:00
2026-07-24 18:38:27 +08:00
2026-07-27 04:14:51 +08:00
2026-07-27 04:14:51 +08:00
2026-07-27 04:14:51 +08:00
2026-07-26 23:06:00 +08:00
2026-07-26 23:06:00 +08:00
2026-07-26 23:06:00 +08:00
2026-07-25 01:58:42 +08:00
2026-07-24 23:43:10 +08:00
2026-07-25 01:58:42 +08:00
2026-07-28 00:00:51 +08:00
2026-07-28 00:00:51 +08:00
2026-07-28 00:00:51 +08:00
2026-07-24 13:57:16 +08:00
2026-07-22 23:07:14 +08:00
2026-07-24 13:57:16 +08:00
2026-07-24 13:57:16 +08:00
2026-07-22 23:07:14 +08:00
2026-07-24 13:57:16 +08:00
2026-07-24 13:57:16 +08:00
2026-07-22 23:07:14 +08:00
2026-07-24 13:57:16 +08:00
2026-07-26 02:33:29 +08:00
2026-07-26 02:33:29 +08:00
2026-07-26 02:33:29 +08:00
2026-07-26 12:43:59 +08:00
2026-07-26 12:43:59 +08:00
2026-07-26 12:43:59 +08:00
2026-07-26 02:33:29 +08:00
2026-07-26 02:33:29 +08:00
2026-07-26 02:33:29 +08:00
2026-07-24 15:10:55 +08:00
2026-07-23 19:33:30 +08:00
2026-07-24 15:10:55 +08:00
2026-07-24 17:39:22 +08:00
2026-07-22 23:07:14 +08:00
2026-07-24 17:39:22 +08:00
2026-07-26 02:33:29 +08:00
2026-07-26 02:33:29 +08:00
2026-07-26 02:33:29 +08:00
2026-07-27 21:17:49 +08:00
2026-07-27 21:17:49 +08:00
2026-07-27 21:17:49 +08:00
2026-07-24 01:40:25 +08:00
2026-07-24 01:40:25 +08:00
2026-07-24 01:40:25 +08:00
2026-07-25 01:58:42 +08:00
2026-07-24 23:43:10 +08:00
2026-07-25 01:58:42 +08:00
2026-07-24 01:40:25 +08:00
2026-07-24 01:40:25 +08:00
2026-07-24 01:40:25 +08:00
2026-07-26 14:00:37 +08:00
2026-07-26 14:00:37 +08:00
2026-07-26 14:00:37 +08:00
2026-07-19 22:52:03 +08:00
2026-07-19 22:52:03 +08:00
2026-07-19 22:52:03 +08:00
2026-07-26 13:13:53 +08:00
2026-07-26 13:13:53 +08:00
2026-07-26 13:13:53 +08:00
2026-07-24 01:40:25 +08:00
2026-07-24 01:40:25 +08:00
2026-07-24 01:40:25 +08:00
2026-07-21 21:11:32 +08:00
2026-07-21 21:11:32 +08:00
2026-07-21 21:11:32 +08:00
2026-07-26 20:51:32 +08:00
2026-07-26 20:51:32 +08:00
2026-07-26 20:51:32 +08:00
2026-07-23 03:15:15 +08:00
2026-07-23 03:15:15 +08:00
2026-07-23 03:15:15 +08:00
2026-07-24 02:09:42 +08:00
2026-07-24 02:09:42 +08:00
2026-07-24 02:09:42 +08:00
2026-07-24 14:55:54 +08:00
2026-07-24 14:55:54 +08:00
2026-07-24 14:55:54 +08:00
2026-07-21 20:15:09 +08:00
2026-07-21 20:15:09 +08:00
2026-07-21 20:15:09 +08:00
2026-07-21 01:13:28 +08:00
2026-07-21 01:13:28 +08:00
2026-07-21 01:13:28 +08:00
2026-07-23 15:54:10 +08:00
2026-07-23 15:54:10 +08:00
2026-07-23 15:54:10 +08:00
2026-07-27 21:20:06 +08:00
2026-07-27 21:20:06 +08:00
2026-07-27 21:20:06 +08:00
2026-07-27 15:49:09 +08:00
2026-07-27 15:49:09 +08:00
2026-07-27 15:49:09 +08:00
2026-07-25 16:43:07 +08:00
2026-07-25 16:43:07 +08:00
2026-07-25 16:43:07 +08:00
2026-07-25 17:45:26 +08:00
2026-07-25 17:45:26 +08:00
2026-07-25 17:45:26 +08:00
2026-07-24 01:40:25 +08:00
2026-07-24 01:40:25 +08:00
2026-07-24 01:40:25 +08:00
2026-07-27 18:58:27 +08:00
2026-07-27 18:58:27 +08:00
2026-07-27 18:58:27 +08:00
2026-07-26 13:13:53 +08:00
2026-07-26 13:13:53 +08:00
2026-07-26 13:13:53 +08:00
2026-07-27 12:04:12 +08:00
2026-07-27 12:04:12 +08:00
2026-07-27 12:04:12 +08:00
2026-07-26 13:42:02 +08:00
2026-07-26 13:42:02 +08:00
2026-07-26 13:42:02 +08:00
2026-07-25 15:11:17 +08:00
2026-07-24 21:50:11 +08:00
2026-07-25 15:11:17 +08:00
2026-07-27 21:17:49 +08:00
2026-07-27 21:17:49 +08:00
2026-07-27 21:17:49 +08:00
2026-07-21 15:57:17 +08:00
2026-07-21 15:57:17 +08:00
2026-07-21 15:57:17 +08:00
2026-07-26 13:13:53 +08:00
2026-07-26 13:13:53 +08:00
2026-07-26 13:13:53 +08:00
2026-07-27 18:07:51 +08:00
2026-07-27 18:07:51 +08:00
2026-07-27 18:07:51 +08:00
2026-07-27 06:24:09 +08:00
2026-07-27 06:24:09 +08:00
2026-07-27 06:24:09 +08:00
2026-07-27 06:24:09 +08:00
2026-07-27 06:24:09 +08:00
2026-07-27 06:24:09 +08:00
2026-07-27 03:54:33 +08:00
2026-07-27 03:54:33 +08:00
2026-07-27 03:54:33 +08:00
2026-07-27 11:22:21 +08:00
2026-07-27 11:22:21 +08:00
2026-07-27 11:22:21 +08:00
2026-07-27 04:14:51 +08:00
2026-07-27 04:14:51 +08:00
2026-07-27 04:14:51 +08:00
2026-07-26 12:17:45 +08:00
2026-07-26 12:17:45 +08:00
2026-07-26 12:17:45 +08:00
2026-07-27 03:52:41 +08:00
2026-07-27 03:52:41 +08:00
2026-07-27 03:52:41 +08:00
2026-07-27 21:04:11 +08:00
2026-07-27 21:04:11 +08:00
2026-07-27 21:04:11 +08:00
2026-07-28 14:56:45 +08:00
2026-07-28 14:56:45 +08:00
2026-07-28 14:56:45 +08:00
01d68dee4e