Bug
os.web.fetch blocks private/internal/reserved addresses (incl. cloud metadata 169.254.169.254, loopback, RFC1918) via assertHostAllowed and pins curl with --resolve so DNS rebinding cannot slip in. Redirects are followed hop-by-hop with re-validation.
os.http.request hits the same curl surface with no SSRF check. Defaults are:
http.hostAllowlist: null (no hostname restriction)http.approvalMode can be never so the model fires GETs freely
A model-controlled call can read instance metadata or LAN hosts while os.web.fetch of the same URL is blocked. Web fetch even steers raw API access to os.http.request, which makes the bypass the documented path.
Expected
Parity for private/internal address rejection on os.http.request, plus rebinding defense when redirects stay enabled. Host allowlist remains an additional public-host restriction when set.
Related
src/tools/os/web-fetch-ssrf-guard.tssrc/tools/os/web-fetch.ts (fetchWithGuard)src/tools/os/http-request.ts
Bug
os.web.fetchblocks private/internal/reserved addresses (incl. cloud metadata169.254.169.254, loopback, RFC1918) viaassertHostAllowedand pins curl with--resolveso DNS rebinding cannot slip in. Redirects are followed hop-by-hop with re-validation.os.http.requesthits the same curl surface with no SSRF check. Defaults are:http.hostAllowlist: null(no hostname restriction)http.approvalModecan beneverso the model fires GETs freelyA model-controlled call can read instance metadata or LAN hosts while
os.web.fetchof the same URL is blocked. Web fetch even steers raw API access toos.http.request, which makes the bypass the documented path.Expected
Parity for private/internal address rejection on
os.http.request, plus rebinding defense when redirects stay enabled. Host allowlist remains an additional public-host restriction when set.Related
src/tools/os/web-fetch-ssrf-guard.tssrc/tools/os/web-fetch.ts(fetchWithGuard)src/tools/os/http-request.ts