01d68dee4e
The only browser-trust guard covered host.pickDirectory, while the consequential methods (session.prompt drives bash) accepted any Host — open to DNS rebinding, where a rebound page reads and writes the API as if same-origin and only the Host header betrays the attacker's domain. The pickDirectory-specific loopback guard becomes a prefix-wide fence: Host must be loopback or an exact host[:port] from the new trustedHosts config, an attached Origin must equal that authority, and explicit cross-site markers are refused; requests without browser markers (curl, tests, native clients) pass, because without a browser there is no confused deputy. The loopback-socket check is dropped — binding policy expresses reachability, and the fence is not an auth layer. The Agent Note records the full threat model and the alternatives. |
||
|---|---|---|
| .. | ||
| api-helpers.spec.ts | ||
| api-request-trust.spec.ts | ||
| client-apply.spec.ts | ||
| connection.spec.ts | ||
| fake-api.ts | ||
| fixture-commands.spec.ts | ||
| fixture.spec.ts | ||
| http-bridge.spec.ts | ||
| node-half.spec.ts | ||