Summary
Two hardening gaps in the everything demo server that matter because demo servers get copied into real deployments:
gzip-file-as-resource has no SSRF protection (tools/gzip-file-as-resource.ts): GZIP_ALLOWED_DOMAINS defaults to empty (line 21), and the domain check only applies "when configured" (line 150) — so by default any http/https URL is fetched, private/link-local/metadata addresses included, with redirects not re-checked. This contrasts with the fetch server, which ships default private-IP refusal. Demo code gets forked; the asymmetry propagates.get-env dumps the entire process.env into the tool result (tools/get-env.ts:28-38, JSON.stringify(process.env, null, 2)) — any prompt-injection source that can phrase a tool call reads every secret in the process (API keys included) straight into the model context. Even for a debug demo, an allowlist (GET_ENV_ALLOWED_KEYS) or opt-in flag would prevent the demo from becoming a deployment exfiltration primitive.
Suggestions
- gzip: reuse the fetch server's
_is_public_address default-deny when the allowlist is empty (or default the allowlist to public-suffix-only behavior);
- get-env: default to a safe allowlist (or require explicit opt-in), and document both knobs in the server README.
Static analysis of main @ bbb701e; happy to PR either fix.
Chengzhi Yi (GitHub @Tardfyou) — yimou@hust.edu.cn
Summary
Two hardening gaps in the
everythingdemo server that matter because demo servers get copied into real deployments:gzip-file-as-resourcehas no SSRF protection (tools/gzip-file-as-resource.ts):GZIP_ALLOWED_DOMAINSdefaults to empty (line 21), and the domain check only applies "when configured" (line 150) — so by default any http/https URL is fetched, private/link-local/metadata addresses included, with redirects not re-checked. This contrasts with the fetch server, which ships default private-IP refusal. Demo code gets forked; the asymmetry propagates.get-envdumps the entireprocess.envinto the tool result (tools/get-env.ts:28-38,JSON.stringify(process.env, null, 2)) — any prompt-injection source that can phrase a tool call reads every secret in the process (API keys included) straight into the model context. Even for a debug demo, an allowlist (GET_ENV_ALLOWED_KEYS) or opt-in flag would prevent the demo from becoming a deployment exfiltration primitive.Suggestions
_is_public_addressdefault-deny when the allowlist is empty (or default the allowlist to public-suffix-only behavior);Static analysis of main @ bbb701e; happy to PR either fix.
Chengzhi Yi (GitHub @Tardfyou) — yimou@hust.edu.cn