#45 os.http.request bypasses SSRF guard that os.web.fetch enforces

[Anonymous]

Originally created by: Bartok9

Bug

os.web.fetch blocks private/internal/reserved addresses (incl. cloud metadata 169.254.169.254, loopback, RFC1918) via assertHostAllowed and pins curl with --resolve so DNS rebinding cannot slip in. Redirects are followed hop-by-hop with re-validation.

os.http.request hits the same curl surface with no SSRF check. Defaults are:

• http.hostAllowlist: null (no hostname restriction)
• http.approvalMode can be never so the model fires GETs freely

A model-controlled call can read instance metadata or LAN hosts while os.web.fetch of the same URL is blocked. Web fetch even steers raw API access to os.http.request, which makes the bypass the documented path.

Expected

Parity for private/internal address rejection on os.http.request, plus rebinding defense when redirects stay enabled. Host allowlist remains an additional public-host restriction when set.

Related

• src/tools/os/web-fetch-ssrf-guard.ts
• src/tools/os/web-fetch.ts (fetchWithGuard)
• src/tools/os/http-request.ts

[Anonymous]

Ticket changed by: Ooooze

• status: open --> closed