4 Releases 5 Tags

RSS Feed

• v1.3.0 a35dc508b0

  Compare

  client: allow injecting an http(s).Agent + reject redirects

  amiller released this 2026-06-04 16:41:35 +00:00 | 3 commits to master since this release

  The HTTP client built its connections with no injectable agent, so a
  server-side caller pointing the client at an attacker-influenced baseURL
  (a tenant's prime_endpoint) had no way to attach an SSRF policy at connect
  time. node's http.request doesn't follow redirects, but a 3xx was treated
  as success and its body mis-parsed.

  • ClientConfig accepts an optional agent; inject one whose connection
    factory refuses internal IPs (incl. DNS-rebinding defense) when the
    baseURL is untrusted. Default stays unguarded for trusted/CLI use — the
    guard belongs in the server.
  • A 3xx response is now an explicit error ("refusing to follow"), so a
    redirect can't be silently mis-handled or, via a future change, followed
    to an internal host.

  Downloads

  • Source Code (ZIP)
  • Source Code (TAR.GZ)