stacklok / toolhive / 29531355551

68%

Build Type

push

github

Committed by web-flow

Commit Message

Guard upstream-DCR HTTP calls against SSRF (#5826)

* Guard upstream-DCR HTTP calls against SSRF

The DCR resolver dialed both the discovery URL and the registration
endpoint with HTTP clients that had no private-IP protection, and gave
callers no way to supply a guarded client. A DCR upstream was therefore
an SSRF vector (CWE-918) even when the caller validated the configured
URL up front: a discovery document could point registration_endpoint at
an in-cluster service or a link-local metadata address, and a validated
endpoint could rebind to a private address at dial time.

Mirror the OAuth2/OIDC upstream posture (safe-by-default):

- Add networking.NewHostScopedClientBuilder as the single source of
  truth for the host-scoped guard policy, and refactor the upstream
  provider's newHTTPClientForHost to delegate to it so the two paths
  cannot drift.
- Dial both resolver outbound calls through a private-IP-guarded client
  with keep-alives disabled, preserving the existing redirect-refusal
  and bearer-token layering on the registration client.
- Add AllowPrivateIPs to dcr.Request as the explicit opt-in for
  in-cluster upstreams, wired from OAuth2UpstreamRunConfig.AllowPrivateIPs
  so DCR shares the upstream's private-IP posture.

Closes #5825

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* Address code review feedback

Fixed issues from code review:
- MEDIUM: Install SameHostRedirectPolicy on the DCR discovery client so a
  malicious upstream 30x cannot walk the metadata fetch onto another host
  (the registration client already refuses all redirects).
- MEDIUM: Thread the private-IP decision into the CLI DCR consumer via
  OAuthFlowConfig.AllowPrivateIPs, wired from the existing TargetIsPrivate
  model at both CLI entrypoints, so a CLI pointed at a private remote is no
  longer newly refused on DCR while a public remote stays guarded.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* Close remaining SSRF guard gaps in CLI DCR ... (continued)

Coverage Stats

103 of 145 new or added lines in 9 files covered. (71.03%)

10 existing lines in 3 files now uncovered.

73973 of 108510 relevant lines covered (68.17%)

64.97 hits per line