@chatpanel/bridge 0.10.13 → 0.10.14

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@chatpanel/bridge",
-  "version": "0.10.13",
+  "version": "0.10.14",
   "type": "module",
   "description": "Local bridge that exposes the AI coding agents installed on your machine — Claude Code (CLI), Codex (CLI), and Gemini CLI — to the ChatPanel Chrome extension over a localhost SSE endpoint. Bring your own agent.",
   "keywords": [

package/src/server.js

@@ -32,11 +32,12 @@ import { installService, uninstallService, serviceStatus, restartService } from
 import { AGENT_CLIS, enrichPath, findAgentBin, resolveCommand } from './env.js';
 import { checkForUpdate, selfUpdate } from './update.js';
 import { callLocalMcp } from './mcp-local.js';
+import { assertPublicHttpUrl } from './ssrf.js';
 
 // Hardcoded (not read from package.json) so it survives Bun's single-file
 // --compile, where package.json isn't on a readable FS. CI fails the publish if
 // this drifts from package.json, so the two can't silently diverge.
-const VERSION = '0.10.13';
+const VERSION = '0.10.14';
 const HOST = process.env.CHATPANEL_BRIDGE_HOST || '127.0.0.1';
 const PORT = Number(process.env.CHATPANEL_BRIDGE_PORT) || 4319;
 
@@ -233,31 +234,12 @@ const PRIVILEGED_POST = new Set([
 ]);
 const PRIVILEGED_GET = new Set(['/debug']);
 
-// SSRF guard for /mcp-remote: the bridge must not become an open relay into the
-// local network. Block non-http(s) schemes and private/loopback/link-local/
-// metadata hosts — on the initial URL AND after any redirect.
-function isBlockedHttpHost(hostname) {
-  const h = String(hostname || '').toLowerCase().replace(/^\[|\]$/g, '');
-  if (!h || h === 'localhost' || h.endsWith('.localhost') || h.endsWith('.local')) return true;
-  if (h === '::1' || h === '::' || h.startsWith('fc') || h.startsWith('fd') || h.startsWith('fe8') || h.startsWith('fe9') || h.startsWith('fea') || h.startsWith('feb')) return true;
-  const m = h.match(/^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/);
-  if (m) {
-    const a = Number(m[1]), b = Number(m[2]);
-    if (a === 0 || a === 127 || a === 10) return true;       // this-host / loopback / RFC1918
-    if (a === 169 && b === 254) return true;                 // link-local + cloud metadata
-    if (a === 172 && b >= 16 && b <= 31) return true;        // RFC1918
-    if (a === 192 && b === 168) return true;                 // RFC1918
-    if (a === 100 && b >= 64 && b <= 127) return true;       // CGNAT
-  }
-  return false;
-}
-function assertPublicHttpUrl(u) {
-  let parsed;
-  try { parsed = new URL(u); } catch { throw new Error(`invalid URL: ${u}`); }
-  if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') throw new Error(`only http(s) URLs allowed (got "${parsed.protocol}")`);
-  if (isBlockedHttpHost(parsed.hostname)) throw new Error(`refusing to proxy a private/loopback/metadata address (${parsed.hostname})`);
-  return parsed;
-}
+// SSRF guard for /mcp-remote lives in ./ssrf.js (assertPublicHttpUrl). Loopback
+// is allowed (the user's own localhost MCP server — the common "via bridge"
+// case; the extension can reach it directly anyway), cloud metadata is always
+// blocked, and other private/LAN ranges are blocked unless the operator sets
+// CHATPANEL_BRIDGE_ALLOW_PRIVATE_HOSTS=1. Checked on the initial URL AND after
+// any redirect.
 
 // Returns an error code if the request must be blocked, else null.
 function guard(req, pathname) {

package/src/ssrf.js

@@ -0,0 +1,102 @@
+// SSRF guard for the /mcp-remote proxy.
+//
+// The bridge proxies ONE JSON-RPC message to a remote MCP server *from this
+// machine* (no browser Origin header), so the extension can reach servers that
+// reject browser origins. That route is already privileged — it requires the
+// extension origin or the per-install bridge token, so a random web page cannot
+// drive it. This guard is the second layer: even when driven by the extension,
+// the bridge must not become a relay that a prompt-injected agent could point at
+// cloud metadata or use to sweep the LAN.
+//
+// Policy:
+//   • Loopback (127.0.0.0/8, ::1, localhost, *.localhost) → ALLOWED.
+//     It's the user's own host — the same place the bridge runs, and a place the
+//     extension can already fetch DIRECTLY. Proxying it grants no new reach; it
+//     only drops the browser Origin header (the whole point of "via bridge").
+//     Localhost MCP servers are the common case.
+//   • Cloud instance metadata (169.254.169.254) → ALWAYS BLOCKED.
+//     This is the sharpest SSRF target (credential theft) and is blocked even
+//     when private hosts are opted in.
+//   • Everything else private/internal (RFC1918, CGNAT, link-local, IPv6 ULA,
+//     0.0.0.0, ::, *.local) → BLOCKED, unless the operator opts in with
+//     CHATPANEL_BRIDGE_ALLOW_PRIVATE_HOSTS=1 (for reaching an MCP server on
+//     another machine on a trusted LAN).
+//   • Non-http(s) schemes → BLOCKED.
+//
+// The same checks run on the initial URL AND after any redirect.
+
+const ALLOW_PRIVATE_HOSTS = /^(1|true|yes|on)$/i.test(
+  process.env.CHATPANEL_BRIDGE_ALLOW_PRIVATE_HOSTS || '',
+);
+
+function ipv4(h) {
+  const m = h.match(/^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/);
+  if (!m) return null;
+  const o = m.slice(1).map(Number);
+  if (o.some((n) => n > 255)) return null;
+  return o;
+}
+
+// Loopback = this host's own services. Reachable by the extension directly, so
+// allowing the bridge to reach it adds no capability.
+export function isLoopbackHost(hostname) {
+  const h = String(hostname || '').toLowerCase().replace(/^\[|\]$/g, '');
+  if (!h) return false;
+  if (h === 'localhost' || h.endsWith('.localhost')) return true;
+  if (h === '::1') return true;
+  const o = ipv4(h);
+  return !!(o && o[0] === 127);
+}
+
+// Cloud instance metadata — credential-theft vector. Always blocked.
+function isMetadataHost(hostname) {
+  const o = ipv4(hostname);
+  return !!(o && o[0] === 169 && o[1] === 254);
+}
+
+export function isBlockedHttpHost(hostname) {
+  const h = String(hostname || '').toLowerCase().replace(/^\[|\]$/g, '');
+  if (!h) return true;
+  if (isLoopbackHost(h)) return false; // user's own host — allowed
+  if (isMetadataHost(h)) return true; // never proxy cloud metadata, even when private is opted in
+  if (ALLOW_PRIVATE_HOSTS) return false; // operator opted in to LAN/private targets
+
+  // Default deny for the rest of the private/internal space.
+  if (h.endsWith('.local')) return true; // mDNS / LAN
+  if (
+    h === '::' ||
+    h.startsWith('fc') ||
+    h.startsWith('fd') || // IPv6 ULA
+    h.startsWith('fe8') ||
+    h.startsWith('fe9') ||
+    h.startsWith('fea') ||
+    h.startsWith('feb') // IPv6 link-local
+  ) {
+    return true;
+  }
+  const o = ipv4(h);
+  if (o) {
+    const [a, b] = o;
+    if (a === 0 || a === 10) return true; // this-host / RFC1918
+    if (a === 172 && b >= 16 && b <= 31) return true; // RFC1918
+    if (a === 192 && b === 168) return true; // RFC1918
+    if (a === 100 && b >= 64 && b <= 127) return true; // CGNAT
+  }
+  return false;
+}
+
+export function assertPublicHttpUrl(u) {
+  let parsed;
+  try {
+    parsed = new URL(u);
+  } catch {
+    throw new Error(`invalid URL: ${u}`);
+  }
+  if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') {
+    throw new Error(`only http(s) URLs allowed (got "${parsed.protocol}")`);
+  }
+  if (isBlockedHttpHost(parsed.hostname)) {
+    throw new Error(`refusing to proxy a private/metadata address (${parsed.hostname})`);
+  }
+  return parsed;
+}