a2acalling 0.6.73 → 0.6.75
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/.a2a-manifest.json +2 -2
- package/.c8rc.json +16 -0
- package/.node-version +1 -0
- package/.serena/project.yml +126 -0
- package/ARCHITECTURE.md +40 -16
- package/CONVENTIONS.md +39 -6
- package/biome.json +27 -0
- package/coverage/base.css +224 -0
- package/coverage/block-navigation.js +87 -0
- package/coverage/favicon.png +0 -0
- package/coverage/index.html +146 -0
- package/coverage/prettify.css +1 -0
- package/coverage/prettify.js +2 -0
- package/coverage/sort-arrow-sprite.png +0 -0
- package/coverage/sorter.js +210 -0
- package/coverage/src/index.html +131 -0
- package/coverage/src/index.js.html +313 -0
- package/coverage/src/lib/agent-card.js.html +418 -0
- package/coverage/src/lib/call-monitor.js.html +700 -0
- package/coverage/src/lib/callbook.js.html +1183 -0
- package/coverage/src/lib/claude-subagent.js.html +2173 -0
- package/coverage/src/lib/client.js.html +2134 -0
- package/coverage/src/lib/config.js.html +1525 -0
- package/coverage/src/lib/conversation-driver.js.html +1909 -0
- package/coverage/src/lib/conversations.js.html +2575 -0
- package/coverage/src/lib/crypto.js.html +424 -0
- package/coverage/src/lib/dashboard-events.js.html +724 -0
- package/coverage/src/lib/disclosure.js.html +2461 -0
- package/coverage/src/lib/external-ip.js.html +718 -0
- package/coverage/src/lib/index.html +506 -0
- package/coverage/src/lib/invite-host.js.html +754 -0
- package/coverage/src/lib/local-request.js.html +292 -0
- package/coverage/src/lib/logger.js.html +2116 -0
- package/coverage/src/lib/openclaw-integration.js.html +1102 -0
- package/coverage/src/lib/pid-file.js.html +394 -0
- package/coverage/src/lib/port-scanner.js.html +334 -0
- package/coverage/src/lib/prompt-template.js.html +1150 -0
- package/coverage/src/lib/runtime-adapter.js.html +2188 -0
- package/coverage/src/lib/summarizer.js.html +553 -0
- package/coverage/src/lib/summary-formatter.js.html +589 -0
- package/coverage/src/lib/summary-prompt.js.html +694 -0
- package/coverage/src/lib/tokens.js.html +2689 -0
- package/coverage/src/lib/turn-timeout.js.html +241 -0
- package/coverage/src/lib/update-checker.js.html +364 -0
- package/coverage/src/lib/update-manager.js.html +1024 -0
- package/coverage/src/routes/a2a.js.html +3724 -0
- package/coverage/src/routes/callbook.js.html +511 -0
- package/coverage/src/routes/dashboard.js.html +4819 -0
- package/coverage/src/routes/index.html +146 -0
- package/coverage/src/server.js.html +3622 -0
- package/coverage/tmp/coverage-1605378-1772576706365-0.json +1 -0
- package/coverage/tmp/coverage-1605384-1772576607459-0.json +1 -0
- package/coverage/tmp/coverage-1605410-1772576631155-0.json +1 -0
- package/coverage/tmp/coverage-1606942-1772576636869-0.json +1 -0
- package/coverage/tmp/coverage-1607004-1772576637454-0.json +1 -0
- package/coverage/tmp/coverage-1607044-1772576637876-0.json +1 -0
- package/coverage/tmp/coverage-1607096-1772576638356-0.json +1 -0
- package/coverage/tmp/coverage-1607145-1772576638777-0.json +1 -0
- package/coverage/tmp/coverage-1607201-1772576639277-0.json +1 -0
- package/coverage/tmp/coverage-1607247-1772576639755-0.json +1 -0
- package/coverage/tmp/coverage-1607317-1772576640083-0.json +1 -0
- package/coverage/tmp/coverage-1607381-1772576640465-0.json +1 -0
- package/coverage/tmp/coverage-1607446-1772576640868-0.json +1 -0
- package/coverage/tmp/coverage-1607501-1772576641662-0.json +1 -0
- package/coverage/tmp/coverage-1607534-1772576641565-0.json +1 -0
- package/coverage/tmp/coverage-1607627-1772576641871-0.json +1 -0
- package/coverage/tmp/coverage-1607665-1772576642172-0.json +1 -0
- package/coverage/tmp/coverage-1607714-1772576642577-0.json +1 -0
- package/coverage/tmp/coverage-1607788-1772576643466-0.json +1 -0
- package/coverage/tmp/coverage-1607924-1772576644678-0.json +1 -0
- package/coverage/tmp/coverage-1607978-1772576645154-0.json +1 -0
- package/coverage/tmp/coverage-1608035-1772576645564-0.json +1 -0
- package/coverage/tmp/coverage-1608106-1772576645967-0.json +1 -0
- package/coverage/tmp/coverage-1608179-1772576648656-0.json +1 -0
- package/coverage/tmp/coverage-1608196-1772576647367-0.json +1 -0
- package/coverage/tmp/coverage-1608217-1772576648557-0.json +1 -0
- package/coverage/tmp/coverage-1608256-1772576651378-0.json +1 -0
- package/coverage/tmp/coverage-1608265-1772576650058-0.json +1 -0
- package/coverage/tmp/coverage-1608289-1772576651358-0.json +1 -0
- package/coverage/tmp/coverage-1608591-1772576660465-0.json +1 -0
- package/coverage/tmp/coverage-1608648-1772576659272-0.json +1 -0
- package/coverage/tmp/coverage-1608665-1772576660374-0.json +1 -0
- package/coverage/tmp/coverage-1608677-1772576661268-0.json +1 -0
- package/coverage/tmp/coverage-1608684-1772576663968-0.json +1 -0
- package/coverage/tmp/coverage-1608692-1772576662575-0.json +1 -0
- package/coverage/tmp/coverage-1608701-1772576663873-0.json +1 -0
- package/coverage/tmp/coverage-1608718-1772576666674-0.json +1 -0
- package/coverage/tmp/coverage-1608725-1772576665463-0.json +1 -0
- package/coverage/tmp/coverage-1608738-1772576666577-0.json +1 -0
- package/coverage/tmp/coverage-1608753-1772576669664-0.json +1 -0
- package/coverage/tmp/coverage-1608763-1772576668275-0.json +1 -0
- package/coverage/tmp/coverage-1608771-1772576669563-0.json +1 -0
- package/coverage/tmp/coverage-1608828-1772576676574-0.json +1 -0
- package/coverage/tmp/coverage-1609244-1772576675272-0.json +1 -0
- package/coverage/tmp/coverage-1609342-1772576676478-0.json +1 -0
- package/coverage/tmp/coverage-1609450-1772576686954-0.json +1 -0
- package/coverage/tmp/coverage-1609841-1772576685466-0.json +1 -0
- package/coverage/tmp/coverage-1609925-1772576686855-0.json +1 -0
- package/coverage/tmp/coverage-1610399-1772576692469-0.json +1 -0
- package/coverage/tmp/coverage-1611283-1772576703062-0.json +1 -0
- package/coverage/tmp/coverage-1611294-1772576703755-0.json +1 -0
- package/docs/assessments/2026-02-27-google-a2a-protocol-assessment.md +292 -0
- package/docs/plans/2026-03-01-a2a-68-openclaw-integration-tests.md +676 -0
- package/docs/plans/2026-03-01-a2a-77-invoke-security-tests.md +661 -0
- package/docs/plans/2026-03-03-a2a-91-macos-packaging-plan.md +144 -0
- package/docs/signing-setup.md +49 -0
- package/eslint.config.js +16 -0
- package/knip.json +17 -0
- package/native/macos/certs/appldevcert.cer +0 -0
- package/native/macos/src-tauri/binaries/.gitkeep +0 -0
- package/native/macos/src-tauri/capabilities/default.json +11 -1
- package/native/macos/src-tauri/entitlements.plist +14 -0
- package/native/macos/src-tauri/src/discovery.rs +14 -3
- package/native/macos/src-tauri/src/health.rs +4 -0
- package/native/macos/src-tauri/src/lib.rs +52 -11
- package/native/macos/src-tauri/src/server.rs +262 -26
- package/native/macos/src-tauri/tauri.conf.json +13 -4
- package/package.json +16 -2
- package/pkg.config.json +14 -0
- package/scripts/build-standalone.sh +106 -0
- package/scripts/install-openclaw.js +3 -5
- package/scripts/smoke-test-standalone.sh +101 -0
- package/scripts/sync-version.sh +28 -0
- package/scripts/verify-app-bundle.sh +34 -0
- package/src/lib/agent-card.js +111 -0
- package/src/lib/client.js +290 -49
- package/src/lib/conversations.js +2 -0
- package/src/lib/local-request.js +69 -0
- package/src/lib/logger.js +2 -0
- package/src/lib/runtime-adapter.js +41 -1
- package/src/routes/a2a.js +393 -66
- package/src/routes/dashboard.js +1 -27
- package/src/server.js +19 -0
- package/.maestro/inbox/release-workflow-spam.md +0 -25
|
@@ -0,0 +1,292 @@
|
|
|
1
|
+
|
|
2
|
+
<!doctype html>
|
|
3
|
+
<html lang="en">
|
|
4
|
+
|
|
5
|
+
<head>
|
|
6
|
+
<title>Code coverage report for src/lib/local-request.js</title>
|
|
7
|
+
<meta charset="utf-8" />
|
|
8
|
+
<link rel="stylesheet" href="../../prettify.css" />
|
|
9
|
+
<link rel="stylesheet" href="../../base.css" />
|
|
10
|
+
<link rel="shortcut icon" type="image/x-icon" href="../../favicon.png" />
|
|
11
|
+
<meta name="viewport" content="width=device-width, initial-scale=1" />
|
|
12
|
+
<style type='text/css'>
|
|
13
|
+
.coverage-summary .sorter {
|
|
14
|
+
background-image: url(../../sort-arrow-sprite.png);
|
|
15
|
+
}
|
|
16
|
+
</style>
|
|
17
|
+
</head>
|
|
18
|
+
|
|
19
|
+
<body>
|
|
20
|
+
<div class='wrapper'>
|
|
21
|
+
<div class='pad1'>
|
|
22
|
+
<h1><a href="../../index.html">All files</a> / <a href="index.html">src/lib</a> local-request.js</h1>
|
|
23
|
+
<div class='clearfix'>
|
|
24
|
+
|
|
25
|
+
<div class='fl pad1y space-right2'>
|
|
26
|
+
<span class="strong">100% </span>
|
|
27
|
+
<span class="quiet">Statements</span>
|
|
28
|
+
<span class='fraction'>69/69</span>
|
|
29
|
+
</div>
|
|
30
|
+
|
|
31
|
+
|
|
32
|
+
<div class='fl pad1y space-right2'>
|
|
33
|
+
<span class="strong">96.55% </span>
|
|
34
|
+
<span class="quiet">Branches</span>
|
|
35
|
+
<span class='fraction'>28/29</span>
|
|
36
|
+
</div>
|
|
37
|
+
|
|
38
|
+
|
|
39
|
+
<div class='fl pad1y space-right2'>
|
|
40
|
+
<span class="strong">100% </span>
|
|
41
|
+
<span class="quiet">Functions</span>
|
|
42
|
+
<span class='fraction'>2/2</span>
|
|
43
|
+
</div>
|
|
44
|
+
|
|
45
|
+
|
|
46
|
+
<div class='fl pad1y space-right2'>
|
|
47
|
+
<span class="strong">100% </span>
|
|
48
|
+
<span class="quiet">Lines</span>
|
|
49
|
+
<span class='fraction'>69/69</span>
|
|
50
|
+
</div>
|
|
51
|
+
|
|
52
|
+
|
|
53
|
+
</div>
|
|
54
|
+
<p class="quiet">
|
|
55
|
+
Press <em>n</em> or <em>j</em> to go to the next uncovered block, <em>b</em>, <em>p</em> or <em>k</em> for the previous block.
|
|
56
|
+
</p>
|
|
57
|
+
<template id="filterTemplate">
|
|
58
|
+
<div class="quiet">
|
|
59
|
+
Filter:
|
|
60
|
+
<input type="search" id="fileSearch">
|
|
61
|
+
</div>
|
|
62
|
+
</template>
|
|
63
|
+
</div>
|
|
64
|
+
<div class='status-line high'></div>
|
|
65
|
+
<pre><table class="coverage">
|
|
66
|
+
<tr><td class="line-count quiet"><a name='L1'></a><a href='#L1'>1</a>
|
|
67
|
+
<a name='L2'></a><a href='#L2'>2</a>
|
|
68
|
+
<a name='L3'></a><a href='#L3'>3</a>
|
|
69
|
+
<a name='L4'></a><a href='#L4'>4</a>
|
|
70
|
+
<a name='L5'></a><a href='#L5'>5</a>
|
|
71
|
+
<a name='L6'></a><a href='#L6'>6</a>
|
|
72
|
+
<a name='L7'></a><a href='#L7'>7</a>
|
|
73
|
+
<a name='L8'></a><a href='#L8'>8</a>
|
|
74
|
+
<a name='L9'></a><a href='#L9'>9</a>
|
|
75
|
+
<a name='L10'></a><a href='#L10'>10</a>
|
|
76
|
+
<a name='L11'></a><a href='#L11'>11</a>
|
|
77
|
+
<a name='L12'></a><a href='#L12'>12</a>
|
|
78
|
+
<a name='L13'></a><a href='#L13'>13</a>
|
|
79
|
+
<a name='L14'></a><a href='#L14'>14</a>
|
|
80
|
+
<a name='L15'></a><a href='#L15'>15</a>
|
|
81
|
+
<a name='L16'></a><a href='#L16'>16</a>
|
|
82
|
+
<a name='L17'></a><a href='#L17'>17</a>
|
|
83
|
+
<a name='L18'></a><a href='#L18'>18</a>
|
|
84
|
+
<a name='L19'></a><a href='#L19'>19</a>
|
|
85
|
+
<a name='L20'></a><a href='#L20'>20</a>
|
|
86
|
+
<a name='L21'></a><a href='#L21'>21</a>
|
|
87
|
+
<a name='L22'></a><a href='#L22'>22</a>
|
|
88
|
+
<a name='L23'></a><a href='#L23'>23</a>
|
|
89
|
+
<a name='L24'></a><a href='#L24'>24</a>
|
|
90
|
+
<a name='L25'></a><a href='#L25'>25</a>
|
|
91
|
+
<a name='L26'></a><a href='#L26'>26</a>
|
|
92
|
+
<a name='L27'></a><a href='#L27'>27</a>
|
|
93
|
+
<a name='L28'></a><a href='#L28'>28</a>
|
|
94
|
+
<a name='L29'></a><a href='#L29'>29</a>
|
|
95
|
+
<a name='L30'></a><a href='#L30'>30</a>
|
|
96
|
+
<a name='L31'></a><a href='#L31'>31</a>
|
|
97
|
+
<a name='L32'></a><a href='#L32'>32</a>
|
|
98
|
+
<a name='L33'></a><a href='#L33'>33</a>
|
|
99
|
+
<a name='L34'></a><a href='#L34'>34</a>
|
|
100
|
+
<a name='L35'></a><a href='#L35'>35</a>
|
|
101
|
+
<a name='L36'></a><a href='#L36'>36</a>
|
|
102
|
+
<a name='L37'></a><a href='#L37'>37</a>
|
|
103
|
+
<a name='L38'></a><a href='#L38'>38</a>
|
|
104
|
+
<a name='L39'></a><a href='#L39'>39</a>
|
|
105
|
+
<a name='L40'></a><a href='#L40'>40</a>
|
|
106
|
+
<a name='L41'></a><a href='#L41'>41</a>
|
|
107
|
+
<a name='L42'></a><a href='#L42'>42</a>
|
|
108
|
+
<a name='L43'></a><a href='#L43'>43</a>
|
|
109
|
+
<a name='L44'></a><a href='#L44'>44</a>
|
|
110
|
+
<a name='L45'></a><a href='#L45'>45</a>
|
|
111
|
+
<a name='L46'></a><a href='#L46'>46</a>
|
|
112
|
+
<a name='L47'></a><a href='#L47'>47</a>
|
|
113
|
+
<a name='L48'></a><a href='#L48'>48</a>
|
|
114
|
+
<a name='L49'></a><a href='#L49'>49</a>
|
|
115
|
+
<a name='L50'></a><a href='#L50'>50</a>
|
|
116
|
+
<a name='L51'></a><a href='#L51'>51</a>
|
|
117
|
+
<a name='L52'></a><a href='#L52'>52</a>
|
|
118
|
+
<a name='L53'></a><a href='#L53'>53</a>
|
|
119
|
+
<a name='L54'></a><a href='#L54'>54</a>
|
|
120
|
+
<a name='L55'></a><a href='#L55'>55</a>
|
|
121
|
+
<a name='L56'></a><a href='#L56'>56</a>
|
|
122
|
+
<a name='L57'></a><a href='#L57'>57</a>
|
|
123
|
+
<a name='L58'></a><a href='#L58'>58</a>
|
|
124
|
+
<a name='L59'></a><a href='#L59'>59</a>
|
|
125
|
+
<a name='L60'></a><a href='#L60'>60</a>
|
|
126
|
+
<a name='L61'></a><a href='#L61'>61</a>
|
|
127
|
+
<a name='L62'></a><a href='#L62'>62</a>
|
|
128
|
+
<a name='L63'></a><a href='#L63'>63</a>
|
|
129
|
+
<a name='L64'></a><a href='#L64'>64</a>
|
|
130
|
+
<a name='L65'></a><a href='#L65'>65</a>
|
|
131
|
+
<a name='L66'></a><a href='#L66'>66</a>
|
|
132
|
+
<a name='L67'></a><a href='#L67'>67</a>
|
|
133
|
+
<a name='L68'></a><a href='#L68'>68</a>
|
|
134
|
+
<a name='L69'></a><a href='#L69'>69</a>
|
|
135
|
+
<a name='L70'></a><a href='#L70'>70</a></td><td class="line-coverage quiet"><span class="cline-any cline-yes">2x</span>
|
|
136
|
+
<span class="cline-any cline-yes">2x</span>
|
|
137
|
+
<span class="cline-any cline-yes">2x</span>
|
|
138
|
+
<span class="cline-any cline-yes">2x</span>
|
|
139
|
+
<span class="cline-any cline-yes">2x</span>
|
|
140
|
+
<span class="cline-any cline-yes">2x</span>
|
|
141
|
+
<span class="cline-any cline-yes">2x</span>
|
|
142
|
+
<span class="cline-any cline-yes">2x</span>
|
|
143
|
+
<span class="cline-any cline-yes">2x</span>
|
|
144
|
+
<span class="cline-any cline-yes">2x</span>
|
|
145
|
+
<span class="cline-any cline-yes">2x</span>
|
|
146
|
+
<span class="cline-any cline-yes">2x</span>
|
|
147
|
+
<span class="cline-any cline-yes">2x</span>
|
|
148
|
+
<span class="cline-any cline-yes">2x</span>
|
|
149
|
+
<span class="cline-any cline-yes">2x</span>
|
|
150
|
+
<span class="cline-any cline-yes">2x</span>
|
|
151
|
+
<span class="cline-any cline-yes">97x</span>
|
|
152
|
+
<span class="cline-any cline-yes">97x</span>
|
|
153
|
+
<span class="cline-any cline-yes">97x</span>
|
|
154
|
+
<span class="cline-any cline-yes">84x</span>
|
|
155
|
+
<span class="cline-any cline-yes">84x</span>
|
|
156
|
+
<span class="cline-any cline-yes">10x</span>
|
|
157
|
+
<span class="cline-any cline-yes">97x</span>
|
|
158
|
+
<span class="cline-any cline-yes">7x</span>
|
|
159
|
+
<span class="cline-any cline-yes">97x</span>
|
|
160
|
+
<span class="cline-any cline-yes">2x</span>
|
|
161
|
+
<span class="cline-any cline-yes">2x</span>
|
|
162
|
+
<span class="cline-any cline-yes">2x</span>
|
|
163
|
+
<span class="cline-any cline-yes">2x</span>
|
|
164
|
+
<span class="cline-any cline-yes">2x</span>
|
|
165
|
+
<span class="cline-any cline-yes">2x</span>
|
|
166
|
+
<span class="cline-any cline-yes">2x</span>
|
|
167
|
+
<span class="cline-any cline-yes">2x</span>
|
|
168
|
+
<span class="cline-any cline-yes">2x</span>
|
|
169
|
+
<span class="cline-any cline-yes">2x</span>
|
|
170
|
+
<span class="cline-any cline-yes">2x</span>
|
|
171
|
+
<span class="cline-any cline-yes">2x</span>
|
|
172
|
+
<span class="cline-any cline-yes">2x</span>
|
|
173
|
+
<span class="cline-any cline-yes">82x</span>
|
|
174
|
+
<span class="cline-any cline-yes">82x</span>
|
|
175
|
+
<span class="cline-any cline-yes">82x</span>
|
|
176
|
+
<span class="cline-any cline-yes">81x</span>
|
|
177
|
+
<span class="cline-any cline-yes">82x</span>
|
|
178
|
+
<span class="cline-any cline-yes">82x</span>
|
|
179
|
+
<span class="cline-any cline-yes">82x</span>
|
|
180
|
+
<span class="cline-any cline-yes">82x</span>
|
|
181
|
+
<span class="cline-any cline-yes">82x</span>
|
|
182
|
+
<span class="cline-any cline-yes">82x</span>
|
|
183
|
+
<span class="cline-any cline-yes">82x</span>
|
|
184
|
+
<span class="cline-any cline-yes">82x</span>
|
|
185
|
+
<span class="cline-any cline-yes">82x</span>
|
|
186
|
+
<span class="cline-any cline-yes">82x</span>
|
|
187
|
+
<span class="cline-any cline-yes">74x</span>
|
|
188
|
+
<span class="cline-any cline-yes">74x</span>
|
|
189
|
+
<span class="cline-any cline-yes">74x</span>
|
|
190
|
+
<span class="cline-any cline-yes">74x</span>
|
|
191
|
+
<span class="cline-any cline-yes">82x</span>
|
|
192
|
+
<span class="cline-any cline-yes">82x</span>
|
|
193
|
+
<span class="cline-any cline-yes">82x</span>
|
|
194
|
+
<span class="cline-any cline-yes">82x</span>
|
|
195
|
+
<span class="cline-any cline-yes">82x</span>
|
|
196
|
+
<span class="cline-any cline-yes">82x</span>
|
|
197
|
+
<span class="cline-any cline-yes">82x</span>
|
|
198
|
+
<span class="cline-any cline-yes">82x</span>
|
|
199
|
+
<span class="cline-any cline-yes">62x</span>
|
|
200
|
+
<span class="cline-any cline-yes">62x</span>
|
|
201
|
+
<span class="cline-any cline-yes">82x</span>
|
|
202
|
+
<span class="cline-any cline-yes">2x</span>
|
|
203
|
+
<span class="cline-any cline-yes">2x</span>
|
|
204
|
+
<span class="cline-any cline-neutral"> </span></td><td class="text"><pre class="prettyprint lang-js">/**
|
|
205
|
+
* Local Request Detection Utilities
|
|
206
|
+
*
|
|
207
|
+
* A2A-73: Extracted from dashboard.js and a2a.js to provide a single,
|
|
208
|
+
* proxy-aware implementation of local request detection. The previous
|
|
209
|
+
* isLoopbackAddress(req.ip) check was insufficient behind reverse proxies
|
|
210
|
+
* because Express (without trust proxy) reports the proxy's IP, not the
|
|
211
|
+
* real client IP.
|
|
212
|
+
*/
|
|
213
|
+
|
|
214
|
+
'use strict';
|
|
215
|
+
|
|
216
|
+
/**
|
|
217
|
+
* Check if an IP address is a loopback address.
|
|
218
|
+
* Handles IPv4, IPv6, and IPv4-mapped IPv6 formats.
|
|
219
|
+
*/
|
|
220
|
+
function isLoopbackAddress(ip) {
|
|
221
|
+
if (!ip) return false;
|
|
222
|
+
if (ip === '::1' || ip === '127.0.0.1' || ip === '::ffff:127.0.0.1') {
|
|
223
|
+
return true;
|
|
224
|
+
}
|
|
225
|
+
// Full 127.0.0.0/8 range is loopback in IPv4
|
|
226
|
+
if (ip.startsWith('127.')) return true;
|
|
227
|
+
return ip.startsWith('::ffff:127.');
|
|
228
|
+
}
|
|
229
|
+
|
|
230
|
+
/**
|
|
231
|
+
* Determine if a request is a direct local connection (not proxied).
|
|
232
|
+
*
|
|
233
|
+
* A2A-73: This is the security-critical check. A request is only considered
|
|
234
|
+
* "direct local" if ALL of these conditions hold:
|
|
235
|
+
* 1. Socket remote address is loopback (the TCP connection is local)
|
|
236
|
+
* 2. Host header targets localhost (not a public hostname)
|
|
237
|
+
* 3. No proxy-forwarding headers are present (rules out nginx/CDN traffic)
|
|
238
|
+
*
|
|
239
|
+
* Without condition 3, any request through a reverse proxy would pass
|
|
240
|
+
* because the proxy connects from 127.0.0.1 to the backend.
|
|
241
|
+
*/
|
|
242
|
+
function isDirectLocalRequest(req) {
|
|
243
|
+
const ip = (req && req.socket && req.socket.remoteAddress) ? req.socket.remoteAddress : req.ip;
|
|
244
|
+
if (!isLoopbackAddress(ip)) return false;
|
|
245
|
+
|
|
246
|
+
const rawHost = String(req.headers.host <span class="branch-0 cbranch-no" title="branch not covered" >|| '')</span>.toLowerCase();
|
|
247
|
+
// Strip port suffix to get the bare hostname for exact matching.
|
|
248
|
+
// This prevents DNS rebinding via e.g. localhost.evil.com or 127.0.0.1.nip.io.
|
|
249
|
+
// Negative lookbehind avoids stripping `:1` from bare IPv6 `::1`.
|
|
250
|
+
const hostname = rawHost.replace(/(?<!:):\d+$/, '');
|
|
251
|
+
const isLocalHost = hostname === 'localhost' ||
|
|
252
|
+
hostname === '127.0.0.1' ||
|
|
253
|
+
hostname === '[::1]' ||
|
|
254
|
+
hostname === '::1';
|
|
255
|
+
if (!isLocalHost) return false;
|
|
256
|
+
|
|
257
|
+
// A2A-73: Reject requests with any proxy-forwarding header. These indicate
|
|
258
|
+
// the request was relayed by nginx, a CDN, or another reverse proxy —
|
|
259
|
+
// even though the socket address is loopback (proxy → backend is local).
|
|
260
|
+
const forwarded = req.headers['x-forwarded-for'] ||
|
|
261
|
+
req.headers['x-forwarded-proto'] ||
|
|
262
|
+
req.headers['x-forwarded-host'] ||
|
|
263
|
+
req.headers['cf-connecting-ip'] ||
|
|
264
|
+
req.headers['x-forwarded-by'] ||
|
|
265
|
+
req.headers['x-real-ip'] ||
|
|
266
|
+
req.headers['forwarded'];
|
|
267
|
+
if (forwarded) return false;
|
|
268
|
+
|
|
269
|
+
return true;
|
|
270
|
+
}
|
|
271
|
+
|
|
272
|
+
module.exports = { isLoopbackAddress, isDirectLocalRequest };
|
|
273
|
+
</pre></td></tr></table></pre>
|
|
274
|
+
|
|
275
|
+
<div class='push'></div><!-- for sticky footer -->
|
|
276
|
+
</div><!-- /wrapper -->
|
|
277
|
+
<div class='footer quiet pad2 space-top1 center small'>
|
|
278
|
+
Code coverage generated by
|
|
279
|
+
<a href="https://istanbul.js.org/" target="_blank" rel="noopener noreferrer">istanbul</a>
|
|
280
|
+
at 2026-03-03T22:25:10.857Z
|
|
281
|
+
</div>
|
|
282
|
+
<script src="../../prettify.js"></script>
|
|
283
|
+
<script>
|
|
284
|
+
window.onload = function () {
|
|
285
|
+
prettyPrint();
|
|
286
|
+
};
|
|
287
|
+
</script>
|
|
288
|
+
<script src="../../sorter.js"></script>
|
|
289
|
+
<script src="../../block-navigation.js"></script>
|
|
290
|
+
</body>
|
|
291
|
+
</html>
|
|
292
|
+
|