Skip to content

fix: prevent DNS-rebinding TOCTOU in safeProxyFetch by pinning resolved IPs #1732

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
cliffhall merged 5 commits into from
Aug 20, 2026
Merged

fix: prevent DNS-rebinding TOCTOU in safeProxyFetch by pinning resolved IPs #1732

Show file tree
Hide file tree
Changes from 3 commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
9140789
fix: prevent DNS-rebinding TOCTOU in safeProxyFetch by pinning resolv…
manjunathbhaskar Jul 21, 2026
0e1bc1d
fix(server): make the pinned lookup honor Node's all:true callback shape
cliffhall Aug 19, 2026
923c58e
fix(server): pin all validated addresses; keep tests out of the build
cliffhall Aug 19, 2026
fb4a753
Merge branch 'v1/main' into fix/dns-rebinding-toctou-safeproxyfetch
cliffhall Aug 20, 2026
af79614
Merge branch 'v1/main' into fix/dns-rebinding-toctou-safeproxyfetch
cliffhall Aug 20, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions .github/workflows/main.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,6 +37,10 @@ jobs:
working-directory: ./client
run: npm test

- name: Run server tests
working-directory: ./server
run: npm test

- run: npm run build

publish:
Expand Down
4 changes: 3 additions & 1 deletion package-lock.json
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

1 change: 1 addition & 0 deletions package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -42,6 +42,7 @@
"start-client": "cd client && npm run preview",
"test": "npm run prettier-check && cd client && npm test",
"test-cli": "cd cli && npm run test",
"test-server": "cd server && npm run test",
"test:e2e": "MCP_AUTO_OPEN_ENABLED=false npm run test:e2e --workspace=client",
"prettier-fix": "prettier --write .",
"prettier-check": "prettier --check .",
Expand Down
8 changes: 6 additions & 2 deletions server/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,15 +24,19 @@
"build": "tsc && shx cp -R static build",
"start": "node build/index.js",
"dev": "tsx watch --clear-screen=false src/index.ts",
"dev:windows": "tsx watch --clear-screen=false src/index.ts < NUL"
"dev:windows": "tsx watch --clear-screen=false src/index.ts < NUL",
"test": "tsc -p tsconfig.test.json && vitest run",
"test:watch": "vitest"
},
"devDependencies": {
"@types/cors": "^2.8.19",
"@types/express": "^5.0.0",
"@types/node": "^22.0.0",
"@types/shell-quote": "^1.7.5",
"@types/ws": "^8.5.12",
"tsx": "^4.19.0",
"typescript": "^5.6.2"
"typescript": "^5.6.2",
"vitest": "^4.1.0"
Comment thread
cliffhall marked this conversation as resolved.
},
"dependencies": {
"@modelcontextprotocol/sdk": "^1.25.2",
Expand Down
Loading