stacklok / toolhive / 34208036424

71%

Build Type

push

github

Committed by web-flow

Commit Message

Merge commit from fork

The dial-time SSRF guard exempted any loopback-resolving address
regardless of URL scheme, while the URL validator only inspected the
host for http:// URLs. An https:// client_id naming 127.0.0.1 or ::1
passed both checks independently, reaching the embedded auth server's
own loopback services (GHSA-6w3g-cmjg-86q2).

Thread the validator's http-loopback decision into the HTTP client so
the dial guard only exempts loopback when that specific request was
the intended http://localhost development exception.

Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>

Coverage Stats

8 of 14 new or added lines in 1 file covered. (57.14%)

61 existing lines in 6 files now uncovered.

79015 of 112669 relevant lines covered (70.13%)

92.92 hits per line