stacklok / toolhive / 39765549312

73%

Build Type

push

github

Committed by web-flow

Commit Message

Merge commit from fork

* Apply loopback Host check to Modern vMCP requests

vMCP relied on go-sdk's StreamableHTTPHandler for DNS-rebinding
protection: on a loopback connection it rejects a request whose Host
header is not a loopback name. Modern (2026-07-28) requests are served
by dispatchModern and never reach go-sdk, so they were not covered,
and neither were /status, /api/backends/health and /metrics on the
transport port and the diagnostics listener. A browser page whose
hostname resolves to 127.0.0.1 could therefore use a local vMCP with
anonymous incoming auth, which is the quick mode default.

Add loopbackHostGuard, which applies go-sdk's rule (same trigger,
predicate and 403 response) and logs rejections at WARN. Install it on
the MCP route ahead of classification, inside audit and telemetry, so
Legacy and Modern requests get the same answer and a rejection is still
audited, and on /status, /api/backends/health and both /metrics
endpoints. Liveness and readiness probes stay unguarded. Requests on a
non-loopback local address (e.g. traffic to a pod IP) are unaffected;
a loopback hop that preserves a non-loopback Host must rewrite it.

Extend the DNS-rebinding regression test with Modern, status, metrics,
probe and positive cases, pin the guard's decisions against go-sdk's
own check, and add a quick mode e2e case.

Fixes GHSA-7h6f-8rq9-53cw

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Signed-off-by: Giuseppe Scuglia <peppescg@gmail.com>

* Limit loopback Host guard to the MCP route

The guard also covered /status, /api/backends/health and both /metrics
endpoints. Those routes are unauthenticated by design and expose only
operational metadata, and guarding them broke setups that work today:
a containerised Prometheus scraping via host.docker.internal (which
cannot override Host), kube-rbac-proxy sidecars, and health checks
through tunnels that keep the client's Host. The MCP route is what the
advisory is about, and ther... (continued)

Coverage Stats

22 of 24 new or added lines in 2 files covered. (91.67%)

51 existing lines in 3 files now uncovered.

88468 of 123762 relevant lines covered (71.48%)

126.55 hits per line