Hacktoberfest 2026: los issues que los mantenedores marcaron para octubre, abiertos y aptos para principiantes. Explorar issues de Hacktoberfest

security: `serve` has no Host allowlist, so a passwordless server answers DNS-rebinding pages

Abierto
  • ¿Algo no está bien?
#1,451 0 comentarios 0 reacciones 0 asignados Ver en GitHub

Los mantenedores suelen responder en 1 día

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
5/5
Tiempo estimado
Más de una semana
Aptitud para principiantes
30/100
Tipo de issue
Error
Claridad
Bastante claro
Estado de actividad
Activo
Stack tecnológico
typescript
Área
cli, security

Línea de trabajo

Start by reading server.ts around the password and browserOriginRefusal checks, then inspect the /altimate/* routes and the existing isTraceShaped list handling. The issue proposes a Host allowlist and also raises trace shape checking and prompt title exposure; agree on scope and expected behavior before implementation. Done means the chosen protections are covered by tests for allowed and refused hosts and the reported trace cases.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

Found during the v0.12.7 release review (CTO, tech lead and compliance reviewers). Deferred because it changes how every serve route is reached, not just this release's.

With no OPENCODE_SERVER_PASSWORD, basic auth is skipped (server.ts ~300) and browserOriginRefusal passes any request without an Origin header. A same-origin fetch after DNS rebinding sends no Origin and Sec-Fetch-Site: same-origin, so it gets through. The server never checks Host. Not verified with a live rebinding; read from the code.

This is the posture of every serve route, but #1415's /altimate/trace routes now serve prompts, SQL and query results, which raises the stakes.

Proposed: refuse any request whose Host isn't loopback (localhost, 127.0.0.1, [::1]) or the configured hostname, at least on /altimate/*.

Related, same routes:

  • GET /altimate/trace/:id/view doesn't shape-check the file like the list does (isTraceShaped), so a foreign JSON file named <id>.json renders a broken page (500) instead of a 404.
  • The list falls back to the raw first prompt as a trace's title (server.ts ~1301), so prompt text appears in list JSON. Consider truncating it.

(v0.12.7 already adds a CSP to the viewer page so script in trace content can't call the API.)

Lenguaje dominante
TypeScript
Estrellas
812
Forks
123
Merge medio
1 d 14 h
PR fusionados (30 d)
88

Preparar el entorno

Abrir en Codespaces

Inicia el contenedor de desarrollo del proyecto en tu navegador, con tu propia cuenta de GitHub.

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de AltimateAI/altimate-code

Todos los issues de AltimateAI/altimate-code

Issues similares

Más issues de TypeScript

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.