fix sec issues

Author: ozzafar

README.md

@@ -275,22 +275,22 @@ Configure DebugMCP behavior in VSCode settings:
 {
   "debugmcp.serverPort": 3001,
   "debugmcp.timeoutInSeconds": 180,
-  "debugmcp.bindHost": "127.0.0.1"
+  "debugmcp.bindHost": ["127.0.0.1", "::1"]
 }
 ```
 
 | Setting | Default | Description |
 |---------|---------|-------------|
 | `debugmcp.serverPort` | `3001` | Port number for the MCP server |
 | `debugmcp.timeoutInSeconds` | `180` | Timeout for debugging operations |
-| `debugmcp.bindHost` | `127.0.0.1` | Network interface the HTTP server binds to. See [Security model](#security-model) before changing. |
+| `debugmcp.bindHost` | `["127.0.0.1", "::1"]` | Network interface(s) the HTTP server binds to. Accepts a string or array of strings. See [Security model](#security-model) before changing. |
 
 ### Security model
 
 DebugMCP exposes powerful debugger primitives (`evaluate_expression`, `start_debugging`, …) over an unauthenticated local HTTP endpoint. To keep that surface safe, the server enforces two controls:
 
-1. **Loopback-only bind.** The HTTP server binds to `127.0.0.1` by default, so other hosts on your network cannot reach `http://<your-ip>:3001/mcp`. The `debugmcp.bindHost` setting lets you opt into a different interface (for example, when forwarding the port into a remote container), but doing so exposes the unauthenticated debugger to anything that can route to that address — do not point it at `0.0.0.0` or a LAN address on an untrusted network.
-2. **Host / Origin header validation.** Every request must carry a `Host` header naming a loopback address (`localhost`, `127.0.0.1`, or `[::1]`); requests with any other `Host` — including those that arrive via DNS rebinding from a malicious webpage — are rejected with HTTP 403. The same check is applied to the `Origin` header when present.
+1. **Loopback-only bind.** The HTTP server binds to the IPv4 and IPv6 loopback addresses (`127.0.0.1` and `::1`) by default, so other hosts on your network cannot reach `http://<your-ip>:3001/mcp`. Binding both families ensures clients that resolve `localhost` to either family connect successfully. The `debugmcp.bindHost` setting (string or array of strings) lets you opt into a different interface (for example, when forwarding the port into a remote container), but doing so exposes the unauthenticated debugger to anything that can route to that address — do not point it at `0.0.0.0` or a LAN address on an untrusted network.
+2. **Host / Origin header validation.** Every request must carry a `Host` header naming a loopback address (`localhost`, `127.0.0.1`, or `[::1]`); any port suffix in the `Host` must also match the server's listening port. Requests with any other `Host` — including those that arrive via DNS rebinding from a malicious webpage — are rejected with HTTP 403. The same loopback check is applied to the `Origin` header when present.
 
 
 ## FAQ

package.json

@@ -79,9 +79,10 @@
           "description": "Port number for the DebugMCP server"
         },
         "debugmcp.bindHost": {
-          "type": "string",
-          "default": "127.0.0.1",
-          "markdownDescription": "Network interface the DebugMCP HTTP server binds to. **Defaults to `127.0.0.1` (loopback only).** ⚠️ **Security warning:** changing this to `0.0.0.0` or a LAN address exposes the unauthenticated MCP debugger — including arbitrary code execution via `evaluate_expression` and `start_debugging` — to every host on the network. Only change this if you fully understand the risk."
+          "type": ["string", "array"],
+          "items": { "type": "string" },
+          "default": ["127.0.0.1", "::1"],
+          "markdownDescription": "Network interface(s) the DebugMCP HTTP server binds to. **Defaults to `[\"127.0.0.1\", \"::1\"]` (IPv4 + IPv6 loopback only).** Accepts a single string or an array of strings. ⚠️ **Security warning:** changing this to `0.0.0.0` or a LAN address exposes the unauthenticated MCP debugger — including arbitrary code execution via `evaluate_expression` and `start_debugging` — to every host on the network. Only change this if you fully understand the risk."
         }
       }
     }

src/debugMCPServer.ts

@@ -33,33 +33,48 @@ const LOOPBACK_HOSTNAMES = new Set<string>([
 ]);
 
 /**
- * Extract just the hostname portion from a Host header value,
- * stripping any port and surrounding brackets for IPv6 literals.
+ * Split a Host header value into its hostname and optional port parts,
+ * stripping surrounding brackets for IPv6 literals.
  */
-function extractHostname(hostHeader: string): string {
+function parseHostHeader(hostHeader: string): { hostname: string; port: string | undefined } {
     const trimmed = hostHeader.trim().toLowerCase();
     // IPv6 literal in brackets, optionally with :port suffix
     if (trimmed.startsWith('[')) {
         const closingBracketIndex = trimmed.indexOf(']');
         if (closingBracketIndex === -1) {
-            return trimmed; // malformed — let caller reject
+            return { hostname: trimmed, port: undefined }; // malformed — let caller reject
         }
-        return trimmed.substring(0, closingBracketIndex + 1);
+        const hostname = trimmed.substring(0, closingBracketIndex + 1);
+        const rest = trimmed.substring(closingBracketIndex + 1);
+        const port = rest.startsWith(':') ? rest.substring(1) : undefined;
+        return { hostname, port };
     }
     // IPv4 or DNS name with optional :port
     const colonIndex = trimmed.indexOf(':');
-    return colonIndex === -1 ? trimmed : trimmed.substring(0, colonIndex);
+    if (colonIndex === -1) {
+        return { hostname: trimmed, port: undefined };
+    }
+    return { hostname: trimmed.substring(0, colonIndex), port: trimmed.substring(colonIndex + 1) };
 }
 
 /**
  * Returns true when the given Host header value names a loopback address.
+ * If expectedPort is provided, any port suffix in the header must match it
+ * (an absent port is allowed). This prevents requests aimed at a different
+ * port (e.g. Host: localhost:99999) from satisfying the allow-list.
  */
-export function isLoopbackHost(hostHeader: string | undefined): boolean {
+export function isLoopbackHost(hostHeader: string | undefined, expectedPort?: number): boolean {
     if (!hostHeader) {
         return false;
     }
-    const hostname = extractHostname(hostHeader);
-    return LOOPBACK_HOSTNAMES.has(hostname);
+    const { hostname, port } = parseHostHeader(hostHeader);
+    if (!LOOPBACK_HOSTNAMES.has(hostname)) {
+        return false;
+    }
+    if (expectedPort !== undefined && port !== undefined && port !== String(expectedPort)) {
+        return false;
+    }
+    return true;
 }
 
 /**
@@ -81,19 +96,19 @@ export function isLoopbackOrigin(originHeader: string | undefined): boolean {
 }
 
 export class DebugMCPServer {
-    private httpServer: http.Server | null = null;
+    private httpServers: http.Server[] = [];
     private port: number;
-    private host: string;
+    private hosts: string[];
     private initialized: boolean = false;
     private debuggingHandler: IDebuggingHandler;
 
-    constructor(port: number, timeoutInSeconds: number, host: string = '127.0.0.1') {
+    constructor(port: number, timeoutInSeconds: number, host: string | string[] = ['127.0.0.1', '::1']) {
         // Initialize the debugging components with dependency injection
         const executor = new DebuggingExecutor();
         const configManager = new ConfigurationManager();
         this.debuggingHandler = new DebuggingHandler(executor, configManager, timeoutInSeconds);
         this.port = port;
-        this.host = host;
+        this.hosts = Array.isArray(host) ? host : [host];
     }
 
     /**
@@ -392,7 +407,7 @@ export class DebugMCPServer {
         }
 
         try {
-            logger.info(`Starting DebugMCP server on ${this.host}:${this.port}...`);
+            logger.info(`Starting DebugMCP server on ${this.hosts.join(', ')}:${this.port}...`);
 
             // Dynamically import express (ES module)
             const expressModule = await import('express');
@@ -404,13 +419,13 @@ export class DebugMCPServer {
             // its domain to 127.0.0.1 will still send Host/Origin = attacker.example,
             // which we reject before any MCP handler runs.
             app.use((req: any, res: any, next: any) => {
-                if (!isLoopbackHost(req.headers['host'])) {
-                    logger.warn(`Rejecting request with non-loopback Host header: ${req.headers['host']}`);
+                if (!isLoopbackHost(req.headers['host'], this.port)) {
+                    logger.warn(`Rejecting request with non-loopback or wrong-port Host header: ${req.headers['host']}`);
                     res.status(403).json({
                         jsonrpc: '2.0',
                         error: {
                             code: -32000,
-                            message: 'Forbidden: Host header is not a loopback address'
+                            message: 'Forbidden: Host header is not a loopback address on the expected port'
                         },
                         id: null
                     });
@@ -516,15 +531,30 @@ export class DebugMCPServer {
                 });
             });
 
-            // Start HTTP server, bound to the configured host (loopback by default)
-            await new Promise<void>((resolve, reject) => {
-                this.httpServer = app.listen(this.port, this.host, () => {
-                    resolve();
+            // Start HTTP server(s), bound to each configured host (loopback IPv4 + IPv6 by default).
+            // Binding to '127.0.0.1' alone does not cover clients that resolve `localhost` to `::1`
+            // (common on IPv6-preferred systems), so we listen on both loopback families explicitly.
+            for (const host of this.hosts) {
+                await new Promise<void>((resolve, reject) => {
+                    const server = app.listen(this.port, host, () => {
+                        this.httpServers.push(server);
+                        resolve();
+                    });
+                    server.on('error', (err: NodeJS.ErrnoException) => {
+                        // EADDRINUSE on the IPv6 loopback is expected on some platforms (e.g. Linux
+                        // with net.ipv6.bindv6only=0) where the IPv4 bind already covers IPv6 via
+                        // dual-stack mapping. Treat as a soft warning instead of a hard failure.
+                        if (err.code === 'EADDRINUSE' && this.httpServers.length > 0) {
+                            logger.warn(`Skipping bind on ${host}:${this.port} (already covered by another loopback bind)`);
+                            resolve();
+                            return;
+                        }
+                        reject(err);
+                    });
                 });
-                this.httpServer.on('error', reject);
-            });
+            }
 
-            logger.info(`DebugMCP server started successfully on ${this.host}:${this.port}`);
+            logger.info(`DebugMCP server started successfully on ${this.hosts.join(', ')}:${this.port}`);
 
         } catch (error) {
             logger.error(`Failed to start DebugMCP server`, error);
@@ -536,12 +566,12 @@ export class DebugMCPServer {
      * Stop the MCP server
      */
     async stop() {
-        // Close the HTTP server
-        if (this.httpServer) {
-            await new Promise<void>((resolve) => {
-                this.httpServer!.close(() => resolve());
-            });
-            this.httpServer = null;
+        // Close all HTTP servers
+        if (this.httpServers.length > 0) {
+            await Promise.all(this.httpServers.map(server =>
+                new Promise<void>((resolve) => server.close(() => resolve()))
+            ));
+            this.httpServers = [];
         }
 
         logger.info('DebugMCP server stopped');

src/extension.ts

@@ -17,16 +17,19 @@ export async function activate(context: vscode.ExtensionContext) {
     const config = vscode.workspace.getConfiguration('debugmcp');
     const timeoutInSeconds = config.get<number>('timeoutInSeconds', 180);
     const serverPort = config.get<number>('serverPort', 3001);
-    const bindHost = config.get<string>('bindHost', '127.0.0.1');
+    const bindHostSetting = config.get<string | string[]>('bindHost', ['127.0.0.1', '::1']);
+    const bindHosts = Array.isArray(bindHostSetting) ? bindHostSetting : [bindHostSetting];
 
     logger.info(`Using timeoutInSeconds: ${timeoutInSeconds} seconds`);
     logger.info(`Using serverPort: ${serverPort}`);
-    logger.info(`Using bindHost: ${bindHost}`);
-    if (bindHost !== '127.0.0.1' && bindHost !== '::1' && bindHost !== 'localhost') {
+    logger.info(`Using bindHost: ${bindHosts.join(', ')}`);
+    const loopbackHosts = new Set(['127.0.0.1', '::1', 'localhost']);
+    const nonLoopback = bindHosts.filter(h => !loopbackHosts.has(h));
+    if (nonLoopback.length > 0) {
         logger.warn(
-            `DebugMCP is bound to '${bindHost}' instead of loopback. ` +
+            `DebugMCP is bound to '${nonLoopback.join(', ')}' instead of loopback. ` +
             `This exposes the unauthenticated debugger to other hosts on the network. ` +
-            `Set 'debugmcp.bindHost' back to '127.0.0.1' unless you fully trust the network.`
+            `Set 'debugmcp.bindHost' back to the default loopback unless you fully trust the network.`
         );
     }
 
@@ -44,7 +47,7 @@ export async function activate(context: vscode.ExtensionContext) {
     try {
         logger.info('Starting MCP server initialization...');
 
-        mcpServer = new DebugMCPServer(serverPort, timeoutInSeconds, bindHost);
+        mcpServer = new DebugMCPServer(serverPort, timeoutInSeconds, bindHosts);
         await mcpServer.initialize();
         await mcpServer.start();
 

src/test/debugMCPServer.security.test.ts

@@ -6,7 +6,7 @@ import * as net from 'net';
 import * as os from 'os';
 import { DebugMCPServer, isLoopbackHost, isLoopbackOrigin } from '../debugMCPServer';
 
-suite('DebugMCPServer security (ICM 31000000603080 / 31000000611073)', () => {
+suite('DebugMCPServer security', () => {
 
     suite('isLoopbackHost', () => {
         test('accepts loopback hostnames with or without port', () => {
@@ -29,6 +29,18 @@ suite('DebugMCPServer security (ICM 31000000603080 / 31000000611073)', () => {
             assert.strictEqual(isLoopbackHost(''), false);
             assert.strictEqual(isLoopbackHost(undefined), false);
         });
+
+        test('with expectedPort, rejects loopback host whose port does not match', () => {
+            assert.strictEqual(isLoopbackHost('localhost:3001', 3001), true);
+            assert.strictEqual(isLoopbackHost('127.0.0.1:3001', 3001), true);
+            assert.strictEqual(isLoopbackHost('[::1]:3001', 3001), true);
+            // Absent port is still allowed (some clients omit it for default ports).
+            assert.strictEqual(isLoopbackHost('localhost', 3001), true);
+            // Wrong port is rejected — prevents Host: localhost:99999 sneaking through.
+            assert.strictEqual(isLoopbackHost('localhost:99999', 3001), false);
+            assert.strictEqual(isLoopbackHost('127.0.0.1:8080', 3001), false);
+            assert.strictEqual(isLoopbackHost('[::1]:8080', 3001), false);
+        });
     });
 
     suite('isLoopbackOrigin', () => {
@@ -55,7 +67,7 @@ suite('DebugMCPServer security (ICM 31000000603080 / 31000000611073)', () => {
         let server: DebugMCPServer;
 
         suiteSetup(async () => {
-            server = new DebugMCPServer(port, 60, '127.0.0.1');
+            server = new DebugMCPServer(port, 60);
             await server.initialize();
             await server.start();
         });
@@ -64,10 +76,10 @@ suite('DebugMCPServer security (ICM 31000000603080 / 31000000611073)', () => {
             await server.stop();
         });
 
-        function postMcp(headers: http.OutgoingHttpHeaders): Promise<{ status: number; body: string }> {
+        function postMcp(headers: http.OutgoingHttpHeaders, hostAddr: string = '127.0.0.1'): Promise<{ status: number; body: string }> {
             const body = JSON.stringify({ jsonrpc: '2.0', id: 1, method: 'tools/list', params: {} });
             const opts: http.RequestOptions = {
-                host: '127.0.0.1',
+                host: hostAddr,
                 port,
                 path: '/mcp',
                 method: 'POST',
@@ -90,7 +102,7 @@ suite('DebugMCPServer security (ICM 31000000603080 / 31000000611073)', () => {
             });
         }
 
-        test('ICM 603080: server is NOT reachable on non-loopback interface', async () => {
+        test('server is NOT reachable on non-loopback interface (LAN exposure)', async () => {
             // Find a non-loopback IPv4 interface on this machine.
             const interfaces = os.networkInterfaces();
             let lanAddr: string | undefined;
@@ -121,22 +133,40 @@ suite('DebugMCPServer security (ICM 31000000603080 / 31000000611073)', () => {
             });
         });
 
-        test('ICM 611073: request with attacker Host header is rejected (403)', async () => {
+        test('request with attacker Host header is rejected (403) — DNS rebinding defense', async () => {
             const res = await postMcp({ Host: 'attacker.example' });
             assert.strictEqual(res.status, 403, `expected 403 for DNS-rebinding Host header, got ${res.status}: ${res.body}`);
         });
 
-        test('ICM 611073: request with non-loopback Origin header is rejected (403)', async () => {
+        test('request with non-loopback Origin header is rejected (403)', async () => {
             const res = await postMcp({ Host: '127.0.0.1', Origin: 'https://attacker.example' });
             assert.strictEqual(res.status, 403, `expected 403 for attacker Origin, got ${res.status}: ${res.body}`);
         });
 
+        test('request with loopback Host but mismatched port is rejected (403)', async () => {
+            const res = await postMcp({ Host: 'localhost:99999' });
+            assert.strictEqual(res.status, 403, `expected 403 for wrong-port Host header, got ${res.status}: ${res.body}`);
+        });
+
         test('loopback request with valid Host header is accepted', async () => {
             const res = await postMcp({ Host: `127.0.0.1:${port}` });
             // Anything other than 403 means the rebinding middleware let it through.
             // We don't validate the exact response shape because MCP handshake semantics
             // are outside the scope of this security test.
             assert.notStrictEqual(res.status, 403, `loopback request was incorrectly rejected: ${res.body}`);
         });
+
+        test('server is reachable over IPv6 loopback (::1)', async () => {
+            try {
+                const res = await postMcp({ Host: `[::1]:${port}` }, '::1');
+                assert.notStrictEqual(res.status, 403, `IPv6 loopback request was incorrectly rejected: ${res.body}`);
+            } catch (err: any) {
+                // ENETUNREACH / EAFNOSUPPORT — host has no IPv6 stack; not a failure of the server.
+                if (err && (err.code === 'ENETUNREACH' || err.code === 'EAFNOSUPPORT' || err.code === 'EADDRNOTAVAIL')) {
+                    return;
+                }
+                throw err;
+            }
+        });
     });
 });