Security: block private script source targets

pkg/compose/script_source.go

@@ -5,6 +5,7 @@ import (
 	"errors"
 	"fmt"
 	"io"
+	"net"
 	"net/http"
 	"net/url"
 	"os"
@@ -35,16 +36,21 @@ func (f ScriptSourceResolverFunc) Resolve(ctx context.Context, source sources.So
 }
 
 type defaultScriptSourceResolver struct {
-	client *http.Client
-	env    map[string]string
+	client                *http.Client
+	env                   map[string]string
+	validateNetworkTarget func(context.Context, *url.URL) error
 }
 
 // NewDefaultScriptSourceResolver returns the bounded file and HTTP(S) resolver
 // used by CLI compose loading.
 func NewDefaultScriptSourceResolver(env map[string]string) ScriptSourceResolver {
-	resolver := &defaultScriptSourceResolver{env: env}
+	resolver := &defaultScriptSourceResolver{env: env, validateNetworkTarget: validateScriptNetworkTarget}
+	transport := http.DefaultTransport.(*http.Transport).Clone()
+	transport.Proxy = nil
+	transport.DialContext = safeScriptDialContext
 	resolver.client = &http.Client{
-		Timeout: defaultScriptSourceTimeout,
+		Timeout:   defaultScriptSourceTimeout,
+		Transport: transport,
 		CheckRedirect: func(req *http.Request, via []*http.Request) error {
 			if len(via) > maxScriptSourceRedirects {
 				return fmt.Errorf("too many redirects (maximum %d)", maxScriptSourceRedirects)
@@ -61,7 +67,7 @@ func NewDefaultScriptSourceResolver(env map[string]string) ScriptSourceResolver
 			if len(via) > 0 && via[len(via)-1].URL.Scheme == "https" && req.URL.Scheme == "http" {
 				return errors.New("HTTPS redirect downgrade to HTTP is not allowed")
 			}
-			return nil
+			return resolver.validateNetworkTarget(req.Context(), req.URL)
 		},
 	}
 	return resolver
@@ -234,6 +240,9 @@ func readScriptFile(path string) ([]byte, error) {
 }
 
 func (r *defaultScriptSourceResolver) readHTTP(ctx context.Context, location *url.URL, source sources.Source) ([]byte, error) {
+	if err := r.validateNetworkTarget(ctx, location); err != nil {
+		return nil, fmt.Errorf("fetch script from %s: %w", redactedScriptURL(location), err)
+	}
 	req, err := http.NewRequestWithContext(ctx, http.MethodGet, location.String(), nil)
 	if err != nil {
 		return nil, fmt.Errorf("create script request for %s", redactedScriptURL(location))
@@ -250,6 +259,62 @@ func (r *defaultScriptSourceResolver) readHTTP(ctx context.Context, location *ur
 	return readLimitedScript(resp.Body)
 }
 
+func validateScriptNetworkTarget(ctx context.Context, target *url.URL) error {
+	host := strings.TrimSpace(target.Hostname())
+	if host == "" {
+		return errors.New("script URL requires a valid host")
+	}
+	addresses, err := net.DefaultResolver.LookupIPAddr(ctx, host)
+	if err != nil {
+		return fmt.Errorf("resolve script URL host: %w", err)
+	}
+	if len(addresses) == 0 {
+		return errors.New("script URL host resolved to no addresses")
+	}
+	for _, address := range addresses {
+		if !isPublicScriptAddress(address.IP) {
+			return fmt.Errorf("script URL host resolves to prohibited address %s", address.IP)
+		}
+	}
+	return nil
+}
+
+func safeScriptDialContext(ctx context.Context, network, address string) (net.Conn, error) {
+	host, port, err := net.SplitHostPort(address)
+	if err != nil {
+		return nil, fmt.Errorf("parse script endpoint: %w", err)
+	}
+	addresses, err := net.DefaultResolver.LookupIPAddr(ctx, host)
+	if err != nil {
+		return nil, fmt.Errorf("resolve script endpoint: %w", err)
+	}
+	dialer := net.Dialer{}
+	var dialErrs error
+	for _, candidate := range addresses {
+		if !isPublicScriptAddress(candidate.IP) {
+			continue
+		}
+		conn, dialErr := dialer.DialContext(ctx, network, net.JoinHostPort(candidate.IP.String(), port))
+		if dialErr == nil {
+			return conn, nil
+		}
+		dialErrs = errors.Join(dialErrs, dialErr)
+	}
+	if dialErrs != nil {
+		return nil, dialErrs
+	}
+	return nil, errors.New("script endpoint has no permitted public address")
+}
+
+func isPublicScriptAddress(ip net.IP) bool {
+	if ip == nil || !ip.IsGlobalUnicast() || ip.IsPrivate() || ip.IsLoopback() || ip.IsLinkLocalUnicast() || ip.IsLinkLocalMulticast() {
+		return false
+	}
+	// Go's IsPrivate intentionally excludes the carrier-grade NAT range.
+	cgnat := &net.IPNet{IP: net.IPv4(100, 64, 0, 0), Mask: net.CIDRMask(10, 32)}
+	return !cgnat.Contains(ip)
+}
+
 func readLimitedScript(reader io.Reader) ([]byte, error) {
 	data, err := io.ReadAll(io.LimitReader(reader, maxScriptSourceBytes+1))
 	if err != nil {

pkg/compose/script_source_test.go

@@ -4,6 +4,7 @@ import (
 	"compress/gzip"
 	"context"
 	"fmt"
+	"net"
 	"net/http"
 	"net/http/httptest"
 	"net/url"
@@ -17,6 +18,28 @@ import (
 	"github.com/chaitin/agent-compose/pkg/sources"
 )
 
+func newTestScriptSourceResolver() *defaultScriptSourceResolver {
+	resolver := NewDefaultScriptSourceResolver(nil).(*defaultScriptSourceResolver)
+	resolver.validateNetworkTarget = func(context.Context, *url.URL) error { return nil }
+	transport := resolver.client.Transport.(*http.Transport).Clone()
+	transport.DialContext = (&net.Dialer{}).DialContext
+	resolver.client.Transport = transport
+	return resolver
+}
+
+func TestDefaultScriptSourceResolverRejectsPrivateHTTPTargets(t *testing.T) {
+	resolver := NewDefaultScriptSourceResolver(nil)
+	for _, location := range []string{
+		"http://127.0.0.1/script.js",
+		"http://169.254.169.254/latest/meta-data/",
+		"http://10.0.0.1/script.js",
+	} {
+		if _, err := resolver.Resolve(context.Background(), sources.Source{Provider: sources.ProviderHTTP, URL: location}); err == nil || !strings.Contains(err.Error(), "prohibited address") {
+			t.Fatalf("Resolve(%q) error = %v, want prohibited address error", location, err)
+		}
+	}
+}
+
 func TestDefaultScriptSourceResolverReadsFilesAndFileURLs(t *testing.T) {
 	dir := t.TempDir()
 	path := filepath.Join(dir, "scheduler script.js")
@@ -27,7 +50,7 @@ func TestDefaultScriptSourceResolverReadsFilesAndFileURLs(t *testing.T) {
 	if err := os.Symlink(path, link); err != nil {
 		t.Fatal(err)
 	}
-	resolver := NewDefaultScriptSourceResolver(nil)
+	resolver := newTestScriptSourceResolver()
 	for _, location := range []string{path, (&url.URL{Scheme: "file", Path: link}).String()} {
 		data, err := resolver.Resolve(context.Background(), sources.Source{Provider: sources.ProviderFile, Path: location})
 		if err != nil || !strings.Contains(string(data), "scheduler.interval") {
@@ -65,7 +88,7 @@ func TestDefaultScriptSourceResolverReadsGitFile(t *testing.T) {
 			t.Fatalf("git %s failed: %v\n%s", strings.Join(args, " "), err, output)
 		}
 	}
-	data, err := NewDefaultScriptSourceResolver(nil).Resolve(context.Background(), sources.Source{
+	data, err := newTestScriptSourceResolver().Resolve(context.Background(), sources.Source{
 		Provider: sources.ProviderGit,
 		URL:      repository,
 		Ref:      "main",
@@ -104,7 +127,7 @@ func TestDefaultScriptSourceResolverRejectsEscapingGitSymlink(t *testing.T) {
 		}
 	}
 
-	data, err := NewDefaultScriptSourceResolver(nil).Resolve(context.Background(), sources.Source{
+	data, err := newTestScriptSourceResolver().Resolve(context.Background(), sources.Source{
 		Provider: sources.ProviderGit,
 		URL:      repository,
 		Ref:      "main",
@@ -121,7 +144,7 @@ func TestDefaultScriptSourceResolverHTTPFailures(t *testing.T) {
 			w.WriteHeader(http.StatusBadGateway)
 		}))
 		defer server.Close()
-		_, err := NewDefaultScriptSourceResolver(nil).Resolve(context.Background(), sources.Source{Provider: sources.ProviderHTTP, URL: server.URL + "/scheduler.js?token=super-secret"})
+		_, err := newTestScriptSourceResolver().Resolve(context.Background(), sources.Source{Provider: sources.ProviderHTTP, URL: server.URL + "/scheduler.js?token=super-secret"})
 		if err == nil || !strings.Contains(err.Error(), "status 502") || strings.Contains(err.Error(), "super-secret") {
 			t.Fatalf("Resolve error = %v", err)
 		}
@@ -134,7 +157,7 @@ func TestDefaultScriptSourceResolverHTTPFailures(t *testing.T) {
 		defer server.Close()
 		ctx, cancel := context.WithTimeout(context.Background(), 20*time.Millisecond)
 		defer cancel()
-		_, err := NewDefaultScriptSourceResolver(nil).Resolve(ctx, sources.Source{Provider: sources.ProviderHTTP, URL: server.URL})
+		_, err := newTestScriptSourceResolver().Resolve(ctx, sources.Source{Provider: sources.ProviderHTTP, URL: server.URL})
 		if err == nil || !strings.Contains(err.Error(), "deadline exceeded") {
 			t.Fatalf("Resolve timeout error = %v", err)
 		}
@@ -147,7 +170,7 @@ func TestDefaultScriptSourceResolverHTTPFailures(t *testing.T) {
 			http.Redirect(w, r, fmt.Sprintf("/%d", n+1), http.StatusFound)
 		}))
 		defer server.Close()
-		_, err := NewDefaultScriptSourceResolver(nil).Resolve(context.Background(), sources.Source{Provider: sources.ProviderHTTP, URL: server.URL + "/0"})
+		_, err := newTestScriptSourceResolver().Resolve(context.Background(), sources.Source{Provider: sources.ProviderHTTP, URL: server.URL + "/0"})
 		if err == nil || !strings.Contains(err.Error(), "too many redirects") {
 			t.Fatalf("Resolve redirects error = %v", err)
 		}
@@ -158,7 +181,7 @@ func TestDefaultScriptSourceResolverHTTPFailures(t *testing.T) {
 			http.Redirect(w, r, "file:///tmp/scheduler.js", http.StatusFound)
 		}))
 		defer server.Close()
-		_, err := NewDefaultScriptSourceResolver(nil).Resolve(context.Background(), sources.Source{Provider: sources.ProviderHTTP, URL: server.URL})
+		_, err := newTestScriptSourceResolver().Resolve(context.Background(), sources.Source{Provider: sources.ProviderHTTP, URL: server.URL})
 		if err == nil || !strings.Contains(err.Error(), "not supported") {
 			t.Fatalf("Resolve redirect error = %v", err)
 		}
@@ -181,7 +204,10 @@ agents:
         provider: http
         url: %s
 `, location))
-	normalized, err := Normalize(spec, NormalizeOptions{ResolveScriptURLs: true})
+	normalized, err := Normalize(spec, NormalizeOptions{
+		ResolveScriptURLs:    true,
+		ScriptSourceResolver: newTestScriptSourceResolver(),
+	})
 	if err != nil {
 		t.Fatalf("Normalize returned error: %v", err)
 	}
@@ -198,14 +224,22 @@ func TestDefaultScriptSourceResolverLimitsDecodedHTTPContent(t *testing.T) {
 		_ = writer.Close()
 	}))
 	defer server.Close()
-	_, err := NewDefaultScriptSourceResolver(nil).Resolve(context.Background(), sources.Source{Provider: sources.ProviderHTTP, URL: server.URL})
+	_, err := newTestScriptSourceResolver().Resolve(context.Background(), sources.Source{Provider: sources.ProviderHTTP, URL: server.URL})
 	if err == nil || !strings.Contains(err.Error(), "exceeds") {
 		t.Fatalf("Resolve oversized content error = %v", err)
 	}
 }
 
-func TestDefaultScriptSourceResolverRejectsHTTPSDowngrade(t *testing.T) {
+func TestDefaultScriptSourceResolverRejectsPrivateRedirect(t *testing.T) {
 	resolver := NewDefaultScriptSourceResolver(nil).(*defaultScriptSourceResolver)
+	req := httptest.NewRequest(http.MethodGet, "http://127.0.0.1/script.js", nil)
+	if err := resolver.client.CheckRedirect(req, nil); err == nil || !strings.Contains(err.Error(), "prohibited address") {
+		t.Fatalf("private redirect error = %v, want prohibited address error", err)
+	}
+}
+
+func TestDefaultScriptSourceResolverRejectsHTTPSDowngrade(t *testing.T) {
+	resolver := newTestScriptSourceResolver()
 	httpsRequest := httptest.NewRequest(http.MethodGet, "https://example.test/source", nil)
 	httpRequest := httptest.NewRequest(http.MethodGet, "http://example.test/target", nil)
 	err := resolver.client.CheckRedirect(httpRequest, []*http.Request{httpsRequest})