registry / openhorse / 0.2.12

openhorse@0.2.12

OpenHorse - Universal Agent Harness Framework. A complete coding CLI agent with tools, MCP, memory system.

Static Scan Results

scanned 5d ago · by rust-scanner

Static analysis flagged 9 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 293 file(s), 2.01 MB of source, external domains: api.openai.com, api.search.brave.com, api.tavily.com, dashscope.aliyuncs.com, duckduckgo.com, github.com, mcp.tavily.com, open.bigmodel.cn

Source & flagged code

1 flagged

dist/tools/web.jsView file

Lines 4-44javascript

4 *

5 * WebFetch: Fetch URL content and process with prompt

6 * WebSearch: delegate search to provider MCP service

7 *

8 * Issue #32 #3.7: SSRF 拦截 - 拒绝访问内网地址 + Content-Length 上限

9 */

10Object.defineProperty(exports, "__esModule", { value: true });

11exports.WEB_TOOLS = exports.webSearchTool = exports.webFetchTool = void 0;

12exports.clearWebFetchCache = clearWebFetchCache;

13exports.resetWebSearchMcpClientForTests = resetWebSearchMcpClientForTests;

14const tool_1 = require("../framework/tool");

15const config_1 = require("../services/config");

16const web_search_mcp_1 = require("../services/web-search-mcp");

17const web_search_provider_1 = require("../services/web-search-provider");

18const web_search_adapters_1 = require("../services/web-search-adapters");

19// ============================================================================

20// SSRF Protection - Issue #32 #3.7

21// ============================================================================

22/** 内网 IP 地址范围（禁止访问） */

23const BLOCKED_IP_PATTERNS = [

24 /^127\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/, // 127.x.x.x (localhost range)

25 /^10\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/, // 10.x.x.x (private class A)

26 /^192\.168\.(\d{1,3})\.(\d{1,3})$/, // 192.168.x.x (private class C)

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/tools/web.jsView on unpkg · L24

27 /^169\.254\.(\d{1,3})\.(\d{1,3})$/, // 169.254.x.x (link-local)

28 /^172\.(1[6-9]|2\d|3[01])\.(\d{1,3})\.(\d{1,3})$/, // 172.16-31.x.x (private class B)

29 /^0\.0\.0\.0$/, // 0.0.0.0

30 /^::1$/, // IPv6 localhost

31 /^fc[0-9a-f]{2}:/i, // IPv6 unique local

32 /^fe[8-9a-f][0-9a-f]:/i, // IPv6 link-local

33];

34/** 禁止访问的主机名 */

35const BLOCKED_HOSTNAMES = [

36 'localhost',

37 'localhost.localdomain',

38 'ip6-localhost',

39 'ip6-loopback',

40 'metadata.google.internal', // GCP metadata server

41 'metadata', // Azure metadata

42 'kubernetes.default', // K8s internal

43 'kubernetes.default.svc',

44];

Source & flagged code

1 flagged · loading source

dist/tools/web.jsView file

24/^127\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/, // 127.x.x.x (localhost range) L25: /^10\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/, // 10.x.x.x (private class A) L26: /^192\.168\.(\d{1,3})\.(\d{1,3})$/, // 192.168.x.x (private class C) ... L180: // Issue #20 修复：启用 redirect: 'follow' 自动跟随重定向 L181: const response = await fetch(url, { L182: headers: { ... L214: } L215: const text = await response.text(); L216: // Convert to markdown if HTML ... L436: output: result.output, L437: metadata: { source: 'websearch-mcp', provider: result.provider, endpoint: result.endpoint, tool: result.toolName }, L438: };

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/tools/web.jsView on unpkg · L24

Findings

1 High3 Medium5 Low

HighCloud Metadata Accessdist/tools/web.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

1 flagged

dist/tools/web.jsView file

Lines 4-44javascript

4 *

5 * WebFetch: Fetch URL content and process with prompt

6 * WebSearch: delegate search to provider MCP service

7 *

8 * Issue #32 #3.7: SSRF 拦截 - 拒绝访问内网地址 + Content-Length 上限

9 */

10Object.defineProperty(exports, "__esModule", { value: true });

11exports.WEB_TOOLS = exports.webSearchTool = exports.webFetchTool = void 0;

12exports.clearWebFetchCache = clearWebFetchCache;

13exports.resetWebSearchMcpClientForTests = resetWebSearchMcpClientForTests;

14const tool_1 = require("../framework/tool");

15const config_1 = require("../services/config");

16const web_search_mcp_1 = require("../services/web-search-mcp");

17const web_search_provider_1 = require("../services/web-search-provider");

18const web_search_adapters_1 = require("../services/web-search-adapters");

19// ============================================================================

20// SSRF Protection - Issue #32 #3.7

21// ============================================================================

22/** 内网 IP 地址范围（禁止访问） */

23const BLOCKED_IP_PATTERNS = [

24 /^127\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/, // 127.x.x.x (localhost range)

25 /^10\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/, // 10.x.x.x (private class A)

26 /^192\.168\.(\d{1,3})\.(\d{1,3})$/, // 192.168.x.x (private class C)

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/tools/web.jsView on unpkg · L24

27 /^169\.254\.(\d{1,3})\.(\d{1,3})$/, // 169.254.x.x (link-local)

28 /^172\.(1[6-9]|2\d|3[01])\.(\d{1,3})\.(\d{1,3})$/, // 172.16-31.x.x (private class B)

29 /^0\.0\.0\.0$/, // 0.0.0.0

30 /^::1$/, // IPv6 localhost

31 /^fc[0-9a-f]{2}:/i, // IPv6 unique local

32 /^fe[8-9a-f][0-9a-f]:/i, // IPv6 link-local

33];

34/** 禁止访问的主机名 */

35const BLOCKED_HOSTNAMES = [

36 'localhost',

37 'localhost.localdomain',

38 'ip6-localhost',

39 'ip6-loopback',

40 'metadata.google.internal', // GCP metadata server

41 'metadata', // Azure metadata

42 'kubernetes.default', // K8s internal

43 'kubernetes.default.svc',

44];