25500234879

Committed 07 May 2026 01:54PM UTC coverage: 64.786% (-0.01%) from 64.796%

Build # 25500234879

Build Type

push

github

Committed by

web-flow

Commit Message

Restrict Windows named-pipe DACL to creating user (#5214)

By default winio.ListenPipe inherits the kernel default DACL, which
on shared, RDP, or Citrix hosts permits any other interactive user
to open the pipe and exercise the entire REST API; OIDC is opt-in
via WithOIDCConfig and not always present.

Set an explicit SDDL granting GenericAll only to the creating user
(OW) and SYSTEM (SY), with the Protected flag (P) so no inherited
ACEs widen the descriptor. Soften the surrounding doc comment to
match what the listener now enforces, and mark the Windows
AF_UNIX fallback path as best-effort since the .sock file inherits
the parent directory's NTFS ACL.

Add http.Server.IdleTimeout as defense in depth across platforms;
winio.MaxInstances defaults to 255, so a slow client must not be
allowed to keep an instance idle indefinitely and starve new
connections.

Co-authored-by: Cursor <cursoragent@cursor.com>

Coverage Stats

63205 of 97560 relevant lines covered (64.79%)

57.83 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

15.15

/pkg/api/server.go

Build SHA Not Found

The commit SHA "ef5e8f7fec5323e4ec8388f5e573854e9c51e7e9" was not found in your repository, so the file cannot be loaded. This may be because you posted from a local development environment, or your CI created an ephemeral commit.

stacklok / toolhive / 25500234879

Source File Press 'n' to go to next uncovered line, 'b' for previous

Build SHA Not Found

Source File
Press 'n' to go to next uncovered line, 'b' for previous