Skip to content

fix(security): harden dashboard-web — loopback-only bind + Host/Origin guard (#2506) #2518

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
pangerlkr wants to merge 2 commits into
base: main
Choose a base branch
from
+8 −3
Open

fix(security): harden dashboard-web — loopback-only bind + Host/Origin guard (#2506) #2518

Changes from 1 commit
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
8c96b95
fix(#2506): harden dashboard-web — loopback-only bind + Host/Origin g…
pangerlkr Jul 14, 2026
4bf738a
fix(#2506): enforce path containment in readProjectConfigAt via asser…
pangerlkr Jul 14, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 6 additions & 2 deletions scripts/dashboard-web.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,6 +12,7 @@
const fs = require('fs');
const path = require('path');
const http = require('http');
const { buildAllowedHostnames, isAllowedHostHeader, isAllowedOrigin } = require('./lib/loopback-guard');

function parsePort(v) {
const n = parseInt(String(v), 10);
Expand All @@ -20,6 +21,8 @@ function parsePort(v) {
}
const PORT = parsePort(process.argv[2] || process.env.ECC_DASHBOARD_PORT || '3456');
const ROOT = path.resolve(__dirname, '..');
const HOST = process.env.ECC_DASHBOARD_HOST || '127.0.0.1';
const ALLOWED = buildAllowedHostnames(HOST);

@chatgpt-codex-connector chatgpt-codex-connector Bot Jul 14, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Allow LAN hosts when binding to all interfaces

When ECC_DASHBOARD_HOST=0.0.0.0 is used for the documented LAN/container access case, this allowlist only includes loopback names plus the literal 0.0.0.0. A browser connecting via the machine or container address sends a Host header such as 192.168.1.10:3456 or host.docker.internal:3456, so the new guard returns 421 and the dashboard is unusable unless the client spoofs Host. Separate the bind address from the accepted public hostnames, or provide an explicit allowed-hosts setting for non-loopback binds.

Useful? React with 👍 / 👎.

@greptile-apps greptile-apps Bot Jul 14, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 security Wildcard Bind Blocks Remote Hosts

When ECC_DASHBOARD_HOST=0.0.0.0 is used for LAN or container access, the server listens on all interfaces but the allowlist only adds the literal host 0.0.0.0. A remote browser sends Host: <machine-ip>:3456 or a DNS name instead, so the new Host guard returns 421 and the documented external access mode does not work.

Rule Used: Treat CLI inputs, URLs, file paths, and subprocess... (source)

Comment on lines +24 to +25

@coderabbitai coderabbitai Bot Jul 14, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🩺 Stability & Availability | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
rg -n "ECC_DASHBOARD_HOST|server\.listen|server\.on\(['\"]error" scripts/dashboard-web.js

Repository: affaan-m/ECC

Length of output: 253

🏁 Script executed:

#!/bin/bash
set -euo pipefail

sed -n '1,120p' scripts/dashboard-web.js
printf '\n---\n'
sed -n '730,800p' scripts/dashboard-web.js

Repository: affaan-m/ECC

Length of output: 19793

🏁 Script executed:

#!/bin/bash
set -euo pipefail

sed -n '1,240p' scripts/lib/loopback-guard.js

Repository: affaan-m/ECC

Length of output: 1816

Validate ECC_DASHBOARD_HOST before using it and add a bind error handler.

buildAllowedHostnames() accepts any string, and server.listen(PORT, HOST, ...) has no error listener. A malformed or unresolvable host will surface as an unhandled startup failure instead of a clear configuration error. Normalize/validate supported loopback host forms before building ALLOWED, and handle listen() errors explicitly.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@scripts/dashboard-web.js` around lines 24 - 25, Validate and normalize
ECC_DASHBOARD_HOST to supported loopback host forms before passing it to
buildAllowedHostnames or server.listen, rejecting malformed or unresolvable
values with a clear configuration error. Add an explicit error handler to the
server.listen startup flow so bind failures are reported cleanly instead of
becoming unhandled errors.

Source: Coding guidelines


function readFrontmatter(p) {
try {
Expand Down Expand Up @@ -756,17 +759,18 @@ handleRoute();
}

const server = http.createServer((req, res) => {
const url = new URL(req.url, 'http://localhost');
if (!isAllowedHostHeader(req.headers['host'], ALLOWED)) { res.writeHead(421, { 'Content-Type': 'text/plain' }); return res.end('421 Misdirected Request'); } if (req.headers['origin'] && !isAllowedOrigin(req.headers['origin'], ALLOWED)) { res.writeHead(403, { 'Content-Type': 'text/plain' }); return res.end('403 Forbidden'); } const url = new URL(req.url, 'http://localhost');
if (url.pathname === '/api/data') {
res.writeHead(200, { 'Content-Type': 'application/json' });
return res.end(JSON.stringify({ agents: loadAgents(), skills: loadSkills(), commands: loadCommands(), rules: loadRules(), mcps: loadMcps(), hooks: loadHooks() }));

}
res.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8' });
res.end(renderHTML({ agents: loadAgents(), skills: loadSkills(), commands: loadCommands(), rules: loadRules(), mcps: loadMcps(), hooks: loadHooks() }));
});

if (require.main === module) {
server.listen(PORT, () => {
server.listen(PORT, HOST, () => {
console.log(`\n ECC Capabilities → http://localhost:${PORT}\n`);

@greptile-apps greptile-apps Bot Jul 14, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Loopback URL Mismatches Bind Host

When ECC_DASHBOARD_HOST is set to a LAN IP or another explicit host, the server binds there but still prints and opens http://localhost:${PORT}. In remote or container workflows, that URL points at the viewer's own machine rather than the dashboard listener, so the configured access path appears broken even when the server started correctly.

Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!

try { const { spawn } = require('child_process'); const p = process.platform; const c = p === 'darwin' ? 'open' : p === 'win32' ? 'start' : 'xdg-open'; if (c === 'start') spawn('cmd', ['/c', 'start', `http://localhost:${PORT}`], { stdio: 'ignore' }); else spawn(c, [`http://localhost:${PORT}`], { stdio: 'ignore' }); } catch { /* best-effort auto-open */ }
});
Comment on lines +773 to 776
Expand Down
Loading