fix: guard public tool URL fetches - #129
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: b8fa6edb97
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| redirectCount += 1 | ||
| ) { | ||
| const timeoutSignal = AbortSignal.timeout(timeoutMs); | ||
| const response = await fetch(currentUrl.href, { |
There was a problem hiding this comment.
When a user supplies an attacker-controlled hostname, validatePublicToolUrl resolves and approves one set of DNS answers, but this fetch(currentUrl.href, ...) performs a separate hostname resolution for the actual connection. A DNS rebinding or split-horizon change between the check and the request can make validation see a public IP while the request connects to 127.0.0.1 or 169.254.169.254, bypassing the SSRF guard; the fetch needs to use the already-vetted IP or a custom lookup/agent tied to that validation result.
Useful? React with 👍 / 👎.
b8fa6ed to
c284475
Compare
1 participant
Summary
safeToolFetchguard for public URL-fetching toolsSecurity proof
/root/.hermes/workspaces/documents/security-audits/2026-06-19/all-repos/saveit/proof-output.json/root/.hermes/workspaces/documents/security-audits/2026-06-19/all-repos/saveit/public-tools-ssrf-fixed.out.jsonVerification
git diff --checkpassedapps/web/__tests__/safe-fetch.test.tspnpm vitest run __tests__/safe-fetch.test.ts, dependency install, and Node-based proof execution could not run on this VPS because Node/WebAssembly allocation OOMed before tests startedNo production network or customer data was touched.