3 people b25c41b02b 🐛 Fix SSRF bypass via DNS rebinding in HTTP request and script fetch flows (#2461) ...

- Add `createSafeDispatcher` with a `validatingLookup` that checks
resolved IPs at TCP connection time, preventing DNS rebinding TOCTOU
attacks (GHSA-hgqq-whf5-mrrf)
- Pass the safe undici dispatcher in `safeFetchWithoutChunkedEncoding`
(`ky.ts`) and in the isolated VM fetch wrapper (`executeFunction.ts`)
- Export `parseIPAddress`, `validateIPAddress` and `ParsedIP` from
`validateHttpReqUrl.ts` for reuse in the dispatcher
- Add unit tests for `validatingLookup` and E2E test bot/spec for SSRF
scenarios
- Add `@types/bun` to `packages/lib` tsconfig

---------

Co-authored-by: Claude Opus 4.6 (1M context) <[email protected]>

2026-04-15 09:28:06 +00:00

..

src

🐛 Fix SSRF bypass via DNS rebinding in HTTP request and script fetch flows (#2461)

2026-04-15 09:28:06 +00:00

package.json

♻️ Migrate to NX (#2418)

2026-03-18 15:29:32 +00:00

tsconfig.json

♻️ Migrate to NX (#2418)

2026-03-18 15:29:32 +00:00

tsconfig.lib.json

🔧 Remove "baseUrl": "." from tsconfigs

2026-03-25 16:40:12 +01:00