Cache DNS guard resolutions and harden the outbound URL guard - #1524
Merged
Conversation
Deploying with
|
| Status | Name | Latest Commit | Preview URL | Updated (UTC) |
|---|---|---|---|---|
| ✅ Deployment successful! View logs |
executor-marketing | 4b2caab | Commit Preview URL Branch Preview URL |
Aug 04 2026, 05:18 AM |
Deploying with
|
| Status | Name | Latest Commit | Updated (UTC) |
|---|---|---|---|
| ✅ Deployment successful! View logs |
executor-cloud | 4b2caab | Aug 04 2026, 05:20 AM |
Contributor
Cloudflare previewTorn down — the PR is closed. |
@executor-js/cli
@executor-js/config
@executor-js/execution
@executor-js/sdk
@executor-js/codemode-core
@executor-js/runtime-quickjs
@executor-js/plugin-file-secrets
@executor-js/plugin-graphql
@executor-js/plugin-keychain
@executor-js/plugin-mcp
@executor-js/plugin-onepassword
@executor-js/plugin-openapi
executor
commit: |
RhysSullivan
force-pushed
the
fix/hosted-dns-guard-latency
branch
from
August 3, 2026 20:33
4128736 to
c1740be
Compare
RhysSullivan
force-pushed
the
fix/hosted-dns-guard-latency
branch
from
August 3, 2026 21:00
c1740be to
802114a
Compare
Refuse a 307/308 that would replay a one-shot body rather than buffering every upload up front. Also strip all trailing dots when canonicalizing a hostname, so appending one does not skip the name blocklist.
…oss-origin hops Every Request input normalizes to a ReadableStream body, which undici rejects unless the init sets duplex. Rebuild the cross-origin init from an explicit field list so referrer and credentials cannot ride past the header safelist.
A dotted quad is legal only at the end of a whole address, and octets are decimal-only: both forms otherwise decode to a public-looking leading word while the resolver dials loopback. Also fail an empty resolver answer so the zero failure TTL drops it instead of blackholing the hostname.
…ined init members
RhysSullivan
marked this pull request as ready for review
August 4, 2026 17:41
This was referenced Aug 4, 2026
Merged
RhysSullivan
added a commit
that referenced
this pull request
Aug 4, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Self-hosted proxying took 5-7s per request; another MCP server through the same tunnel answered in ~1s.
Every outbound request ran an uncached
getaddrinfoin the SSRF guard before the fetch, and again for each redirect hop. On a network whose resolver drops AAAA queries — common behind IPv4-only home routers — that lookup stalls for the resolver timeout. Reproduced in a container with a stub resolver that answers A and drops AAAA: 6-9s on every call.Guard resolutions are now cached per hostname (60s TTL, 256 entries, per guarded-fetch adapter). Failures aren't retained, concurrent callers share one in-flight resolution, and the lookup runs on a detached fiber so one caller's abort can't interrupt the resolution others are waiting on. Same repro after: 2022ms, then 1ms, 0ms.
The cache made a few pre-existing guard weaknesses load-bearing, so they're fixed here too:
[::169.254.169.254]was allowed — classification read the leading group of a compressed literal rather than expanding to eight words. Now handles v4-mapped, v4-compatible and NAT64 prefixes by their embedded IPv4 destination.beef.cafe) were treated as IP literals and skipped the resolved-address check.metadata.google.internal.(trailing root dot) missed the exact-match blocklist — reachable wheneverallowLocalNetworkis set, which is the one check meant to hold unconditionally. Hostnames are canonicalized once at the boundary.ReadableStreambody was replayed already-drained across a redirect (hop 1: 19 bytes, hop 2: 0, response 200).FetchHttpClientpasses a stream for every streamed body, so this was the common path. Bodies are buffered up front.All fibers interrupted without errorinstead of anAbortError, which callers branching onerror.nameread as a transport failure and retry.Known limitation
The guard hands the underlying fetch a hostname, never the address it checked, so the fetch resolves independently and the verdict is advisory: an attacker serving a TTL-0 record wins in the unresolved gap. The cache lengthens that gap from milliseconds to the TTL — it widens an existing hole rather than opening one. Pinning the connection to the checked address is the fix and is not in this PR; a zero TTL would restore the per-request stall without closing anything.
Verification
41 guard tests, 541 sdk tests, lint and typecheck clean. Mutation-tested: 11 mutations, 10 killed. The uncovered one removes
response.body?.cancel()on abandoned 3xx responses —Responsefixtures have no undici connection to leak, so there's nothing observable to assert.