Skip to content

fix(security): harden dashboard-web — loopback-only bind + Host/Origin guard (#2506) #2518

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
pangerlkr wants to merge 2 commits into
base: main
Choose a base branch
from
+8 −3
Open

fix(security): harden dashboard-web — loopback-only bind + Host/Origin guard (#2506) #2518

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
8c96b95
fix(#2506): harden dashboard-web — loopback-only bind + Host/Origin g…
pangerlkr Jul 14, 2026
4bf738a
fix(#2506): enforce path containment in readProjectConfigAt via asser…
pangerlkr Jul 14, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 6 additions & 2 deletions scripts/dashboard-web.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,6 +12,7 @@
const fs = require('fs');
const path = require('path');
const http = require('http');
const { buildAllowedHostnames, isAllowedHostHeader, isAllowedOrigin } = require('./lib/loopback-guard');

function parsePort(v) {
const n = parseInt(String(v), 10);
Expand All @@ -20,6 +21,8 @@ function parsePort(v) {
}
const PORT = parsePort(process.argv[2] || process.env.ECC_DASHBOARD_PORT || '3456');
const ROOT = path.resolve(__dirname, '..');
const HOST = process.env.ECC_DASHBOARD_HOST || '127.0.0.1';
const ALLOWED = buildAllowedHostnames(HOST);

@chatgpt-codex-connector chatgpt-codex-connector Bot Jul 14, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Allow LAN hosts when binding to all interfaces

When ECC_DASHBOARD_HOST=0.0.0.0 is used for the documented LAN/container access case, this allowlist only includes loopback names plus the literal 0.0.0.0. A browser connecting via the machine or container address sends a Host header such as 192.168.1.10:3456 or host.docker.internal:3456, so the new guard returns 421 and the dashboard is unusable unless the client spoofs Host. Separate the bind address from the accepted public hostnames, or provide an explicit allowed-hosts setting for non-loopback binds.

Useful? React with 👍 / 👎.

@greptile-apps greptile-apps Bot Jul 14, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 security Wildcard Bind Blocks Remote Hosts

When ECC_DASHBOARD_HOST=0.0.0.0 is used for LAN or container access, the server listens on all interfaces but the allowlist only adds the literal host 0.0.0.0. A remote browser sends Host: <machine-ip>:3456 or a DNS name instead, so the new Host guard returns 421 and the documented external access mode does not work.

Rule Used: Treat CLI inputs, URLs, file paths, and subprocess... (source)

Comment on lines +24 to +25

@coderabbitai coderabbitai Bot Jul 14, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🩺 Stability & Availability | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
rg -n "ECC_DASHBOARD_HOST|server\.listen|server\.on\(['\"]error" scripts/dashboard-web.js

Repository: affaan-m/ECC

Length of output: 253

🏁 Script executed:

#!/bin/bash
set -euo pipefail

sed -n '1,120p' scripts/dashboard-web.js
printf '\n---\n'
sed -n '730,800p' scripts/dashboard-web.js

Repository: affaan-m/ECC

Length of output: 19793

🏁 Script executed:

#!/bin/bash
set -euo pipefail

sed -n '1,240p' scripts/lib/loopback-guard.js

Repository: affaan-m/ECC

Length of output: 1816

Validate ECC_DASHBOARD_HOST before using it and add a bind error handler.

buildAllowedHostnames() accepts any string, and server.listen(PORT, HOST, ...) has no error listener. A malformed or unresolvable host will surface as an unhandled startup failure instead of a clear configuration error. Normalize/validate supported loopback host forms before building ALLOWED, and handle listen() errors explicitly.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@scripts/dashboard-web.js` around lines 24 - 25, Validate and normalize
ECC_DASHBOARD_HOST to supported loopback host forms before passing it to
buildAllowedHostnames or server.listen, rejecting malformed or unresolvable
values with a clear configuration error. Add an explicit error handler to the
server.listen startup flow so bind failures are reported cleanly instead of
becoming unhandled errors.

Source: Coding guidelines


function readFrontmatter(p) {
try {
Expand Down Expand Up @@ -756,17 +759,18 @@ handleRoute();
}

const server = http.createServer((req, res) => {
const url = new URL(req.url, 'http://localhost');
if (!isAllowedHostHeader(req.headers['host'], ALLOWED)) { res.writeHead(421, { 'Content-Type': 'text/plain' }); return res.end('421 Misdirected Request'); } if (req.headers['origin'] && !isAllowedOrigin(req.headers['origin'], ALLOWED)) { res.writeHead(403, { 'Content-Type': 'text/plain' }); return res.end('403 Forbidden'); } const url = new URL(req.url, 'http://localhost');
if (url.pathname === '/api/data') {
res.writeHead(200, { 'Content-Type': 'application/json' });
return res.end(JSON.stringify({ agents: loadAgents(), skills: loadSkills(), commands: loadCommands(), rules: loadRules(), mcps: loadMcps(), hooks: loadHooks() }));

}
res.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8' });
res.end(renderHTML({ agents: loadAgents(), skills: loadSkills(), commands: loadCommands(), rules: loadRules(), mcps: loadMcps(), hooks: loadHooks() }));
});

if (require.main === module) {
server.listen(PORT, () => {
server.listen(PORT, HOST, () => {
console.log(`\n ECC Capabilities → http://localhost:${PORT}\n`);

@greptile-apps greptile-apps Bot Jul 14, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Loopback URL Mismatches Bind Host

When ECC_DASHBOARD_HOST is set to a LAN IP or another explicit host, the server binds there but still prints and opens http://localhost:${PORT}. In remote or container workflows, that URL points at the viewer's own machine rather than the dashboard listener, so the configured access path appears broken even when the server started correctly.

Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!

try { const { spawn } = require('child_process'); const p = process.platform; const c = p === 'darwin' ? 'open' : p === 'win32' ? 'start' : 'xdg-open'; if (c === 'start') spawn('cmd', ['/c', 'start', `http://localhost:${PORT}`], { stdio: 'ignore' }); else spawn(c, [`http://localhost:${PORT}`], { stdio: 'ignore' }); } catch { /* best-effort auto-open */ }
});
Expand Down
3 changes: 2 additions & 1 deletion scripts/lib/agent-data-home.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,6 +14,7 @@

const fs = require('fs');
const path = require('path');
const { assertWithinTrustedRoot } = require('./path-safety');

const AGENT_DATA_HOME_ENV = 'ECC_AGENT_DATA_HOME';
const DEFAULT_CLAUDE_DIR_NAME = '.claude';
Expand Down Expand Up @@ -104,7 +105,7 @@ function readProjectConfigAt(configPath) {
const candidate = parsed.agentDataHome || parsed.ECC_AGENT_DATA_HOME;
if (typeof candidate !== 'string' || !candidate.trim()) return null;
const projectRoot = resolveProjectRootFromConfigPath(configPath);
return expandHomePath(candidate, projectRoot);
const resolved = expandHomePath(candidate, projectRoot); assertWithinTrustedRoot(resolved, getHomeDirFromEnv(), 'agent-data-home write'); return resolved;

@coderabbitai coderabbitai Bot Jul 14, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

printf '== file map ==\n'
git ls-files 'scripts/lib/agent-data-home.js' 'scripts/lib/*.js' | sed -n '1,120p'

printf '\n== outline ==\n'
ast-grep outline scripts/lib/agent-data-home.js --view expanded || true

printf '\n== relevant source ==\n'
nl -ba scripts/lib/agent-data-home.js | sed -n '1,220p'

printf '\n== search for helper definitions/usages ==\n'
rg -n "assertWithinTrustedRoot|expandHomePath|getHomeDirFromEnv|agent-data-home write" scripts/lib scripts -g '*.js' -A 3 -B 3

Repository: affaan-m/ECC

Length of output: 4911

🏁 Script executed:

#!/bin/bash
set -euo pipefail

python3 - <<'PY'
from pathlib import Path
p = Path('scripts/lib/agent-data-home.js')
print(p.exists(), p.stat().st_size if p.exists() else None)
PY

Repository: affaan-m/ECC

Length of output: 160

🏁 Script executed:

#!/bin/bash
set -euo pipefail

printf '== agent-data-home.js (selected ranges) ==\n'
sed -n '1,240p' scripts/lib/agent-data-home.js

printf '\n== path-safety.js (selected ranges) ==\n'
sed -n '1,240p' scripts/lib/path-safety.js

printf '\n== usages of resolveAgentDataHome / ensureAgentDataHomeEnv / assertWithinTrustedRoot ==\n'
rg -n "resolveAgentDataHome|ensureAgentDataHomeEnv|assertWithinTrustedRoot" scripts/lib scripts -g '*.js' -A 2 -B 2

Repository: affaan-m/ECC

Length of output: 22859

🏁 Script executed:

#!/bin/bash
set -euo pipefail

python3 - <<'PY'
from pathlib import Path
for p in [Path('scripts/lib/agent-data-home.js'), Path('scripts/lib/path-safety.js')]:
    print(f'## {p}')
    print('\n'.join(f'{i+1:4d}: {line}' for i, line in enumerate(p.read_text().splitlines())))
    print()
PY

Repository: affaan-m/ECC

Length of output: 11033

🏁 Script executed:

#!/bin/bash
set -euo pipefail

python3 - <<'PY'
from pathlib import Path

for file in ['scripts/lib/agent-data-home.js', 'scripts/lib/path-safety.js']:
    p = Path(file)
    print(f'===== {file} =====')
    for i, line in enumerate(p.read_text().splitlines(), start=1):
        if i <= 240:
            print(f'{i:4d}: {line}')
    print()
PY

printf '===== usages =====\n'
rg -n "resolveAgentDataHome|ensureAgentDataHomeEnv|assertWithinTrustedRoot" scripts/lib scripts -g '*.js' -A 3 -B 3

Repository: affaan-m/ECC

Length of output: 29032

🏁 Script executed:

#!/bin/bash
set -euo pipefail

python3 - <<'PY'
from pathlib import Path

def show(file, start=None, end=None):
    p = Path(file)
    print(f'===== {file} =====')
    lines = p.read_text().splitlines()
    for i, line in enumerate(lines, start=1):
        if start is not None and i < start:
            continue
        if end is not None and i > end:
            break
        print(f'{i:4d}: {line}')
    print()

show('scripts/lib/agent-data-home.js', 1, 240)
show('scripts/lib/path-safety.js', 1, 220)
PY

printf '===== symbol usages =====\n'
rg -n "assertWithinTrustedRoot|resolveAgentDataHome|ensureAgentDataHomeEnv" scripts/lib -g '*.js' -A 4 -B 4

Repository: affaan-m/ECC

Length of output: 20720

🏁 Script executed:

#!/bin/bash
set -euo pipefail

python3 - <<'PY'
from pathlib import Path
p = Path('scripts/lib/path-safety.js')
print('exists:', p.exists(), 'size:', p.stat().st_size if p.exists() else None)
if p.exists():
    text = p.read_text().splitlines()
    for i, line in enumerate(text, start=1):
        if 'assertWithinTrustedRoot' in line or 'realpath' in line or 'resolve(' in line:
            print(f'{i:4d}: {line}')
PY

printf '\n===== all call sites =====\n'
rg -n "assertWithinTrustedRoot\(" scripts/lib -g '*.js' -A 2 -B 2

Repository: affaan-m/ECC

Length of output: 2957

🌐 Web query:

"affaan-m/ECC scripts/lib/agent-data-home.js assertWithinTrustedRoot"

💡 Result:

The function assertWithinTrustedRoot is a security-related validation utility found within the affaan-m/ECC (Everything Claude Code) repository [1][2]. It is primarily implemented in or used in conjunction with scripts located in scripts/lib/, such as agent-data-home.js, to ensure that file system operations or path resolutions remain within designated "trusted" boundaries [3][4]. In the context of the ECC agent harness, these trust boundaries are critical for preventing unauthorized file access or directory escapes [5][6]. The implementation generally performs the following: 1. Path Canonicalization: It resolves the given path (often using realpath techniques) to its absolute, canonical form, ensuring all symlinks are expanded [7]. 2. Boundary Validation: It compares the resolved path against a defined trusted root directory [7]. 3. Security Enforcement: If the path is determined to be outside the trusted root, the function typically triggers an error or a validation failure, adhering to a "fail-closed" security posture [5][7]. This utility is part of a broader set of security controls within the ECC ecosystem—which includes input validation, origin allowlisting, and trust-check adapters—designed to protect the agent harness from malicious or accidental directory traversal attacks during operations like agent data management or tool execution [5][8][9][3].

Citations:

🌐 Web query:

"\"assertWithinTrustedRoot\" \"agent-data-home\""

💡 Result:

The terms "assertWithinTrustedRoot" and "agent-data-home" are associated with filesystem security and path validation in software environments, particularly within agent-based or data-handling toolchains [1][2]. assertWithinTrustedRoot This appears to be a specific security function or pattern used to prevent "root-scatter" or path traversal attacks [1][2]. - It functions as a validation mechanism that ensures a given target path is strictly contained within a designated "trusted" root directory [2]. - In implementations (such as the qmdc crate or general Rust path-handling utilities), it typically canonicalizes both the root and the target path before comparison to ensure accuracy [2]. - If the target path is found to escape the defined root, the operation fails (often returning an error such as OutOfRoot), acting as a "fail-closed" security invariant [2]. agent-data-home This term refers to a directory path used for local persistent storage and configuration within agent frameworks [3][4][5]. - It is often configurable via environment variables (e.g., to support multi-harness isolation, where different agent sessions or instances require separate data spaces) [3][6][4]. - While "agent data home" can refer to generic directory configurations in various tools (such as Elastic Agent [5]), in the context of recent agent-development tooling (like Everything Claude Code or related CLI tools), it is used to manage persistent hooks, session metrics, learned skills, and other stateful data across multiple environment configurations [3][6][4]. Relationship The two concepts are often used together in secure agent architectures: "agent-data-home" defines the base directory for an agent's data, and "assertWithinTrustedRoot" (or similar path-containment logic) is applied to ensure that the agent does not perform operations or write files outside of its assigned sandbox or data home, thereby preventing unauthorized access to the host filesystem [1][2].

Citations:

Return the canonicalized path from assertWithinTrustedRoot in readProjectConfigAt.
resolved is validated, but the helper’s realpath is dropped, so later writes can still follow the original symlinked path.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@scripts/lib/agent-data-home.js` at line 108, Update readProjectConfigAt to
return the canonical path produced by assertWithinTrustedRoot rather than
discarding that helper’s return value. Preserve the existing expandHomePath and
trusted-root validation flow while ensuring subsequent writes use the
canonicalized path.

} catch (error) {
console.error(
`[ECC] Failed to read or parse agent data config at ${configPath}: ${error.message}`
Expand Down
Loading