stacklok / toolhive / 28087037781

67%

Build Type

push

github

Committed by web-flow

Commit Message

Merge commit from fork

* Guard auth-discovery HTTP clients against redirect SSRF

The remote MCP server auth-discovery clients followed HTTP redirects with
no host or scheme restriction. A malicious server could return a 30x that
pointed the host-side request at an internal address (cloud IMDS, RFC1918
services), turning discovery into an SSRF (CWE-918). This is the one
outbound path that never received the redirect guards already applied to
the transparent proxy, the DCR resolver, and the CIMD fetch.

Add networking.SameHostRedirectPolicy: a CheckRedirect that follows only
same-host (host:port) redirects, refuses HTTPS->HTTP downgrades, and caps
the chain at MaxRedirects, mirroring the transparent-proxy data-path guard.
Install it on the three discovery sinks: DetectAuthenticationFromServer,
FetchResourceMetadata, and the DiscoverActualIssuer default client. Rewrite
the three #nosec G704 rationale comments that asserted the URL was trusted
internal config; the URL is server-controlled and is now contained by the
redirect policy.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* Block private-IP discovery fetches for public targets

The redirect guard stops a malicious server using a 30x to reach an
internal address, but a server can still name a private address directly
in the WWW-Authenticate resource_metadata parameter or a discovered issuer
URL, so the host issues that first-hop GET with no address filtering.

Gate a dial-time private-IP block on whether the operator-configured target
is public. TargetIsPrivate resolves the target host; when it is public, the
server-influenced fetches (resource_metadata, realm-derived issuer,
authorization_servers, well-known) refuse to dial private, loopback, or
link-local addresses on every hop via NewPrivateIPBlockingDialContext. When
the operator deliberately targets an internal server the block is disabled,
so legitimately-internal auth metadata stays reachable and no internal
deployment regresses.... (continued)

Coverage Stats

101 of 106 new or added lines in 5 files covered. (95.28%)

14 existing lines in 5 files now uncovered.

69662 of 103689 relevant lines covered (67.18%)

66.42 hits per line