fix(browser): validate cdp websocket pivots

eleqtrizit · steipete · commit 80720b49942e · 2026-04-04T19:48:01.000+09:00
diff --git a/extensions/browser/src/browser/cdp.test.ts b/extensions/browser/src/browser/cdp.test.ts
@@ -227,6 +227,23 @@ describe("cdp", () => {
     expect(created.targetId).toBe("TARGET_LOCAL");
   });
 
+  it("blocks cross-host websocket pivots returned by /json/version in strict SSRF mode", async () => {
+    const httpPort = await startVersionHttpServer({
+      webSocketDebuggerUrl: "ws://169.254.169.254:9222/devtools/browser/PIVOT",
+    });
+
+    await expect(
+      createTargetViaCdp({
+        cdpUrl: `http://127.0.0.1:${httpPort}`,
+        url: "https://example.com",
+        ssrfPolicy: {
+          dangerouslyAllowPrivateNetwork: false,
+          allowedHostnames: ["127.0.0.1"],
+        },
+      }),
+    ).rejects.toBeInstanceOf(SsrFBlockedError);
+  });
+
   it("evaluates javascript via CDP", async () => {
     const wsPort = await startWsServerWithMessages((msg, socket) => {
       if (msg.method === "Runtime.enable") {
diff --git a/extensions/browser/src/browser/cdp.ts b/extensions/browser/src/browser/cdp.ts
@@ -1,6 +1,7 @@
 import type { SsrFPolicy } from "../infra/net/ssrf.js";
 import {
   appendCdpPath,
+  assertCdpEndpointAllowed,
   fetchJson,
   isLoopbackHost,
   isWebSocketUrl,
@@ -194,6 +195,7 @@ export async function createTargetViaCdp(opts: {
     if (!wsUrl) {
       throw new Error("CDP /json/version missing webSocketDebuggerUrl");
     }
+    await assertCdpEndpointAllowed(wsUrl, opts.ssrfPolicy);
   }
 
   return await withCdpSocket(wsUrl, async (send) => {
diff --git a/extensions/browser/src/browser/chrome.test.ts b/extensions/browser/src/browser/chrome.test.ts
@@ -6,11 +6,13 @@ import os from "node:os";
 import path from "node:path";
 import { afterAll, afterEach, beforeAll, beforeEach, describe, expect, it, vi } from "vitest";
 import { WebSocketServer } from "ws";
+import { SsrFBlockedError } from "../infra/net/ssrf.js";
 import {
   decorateOpenClawProfile,
   ensureProfileCleanExit,
   findChromeExecutableMac,
   findChromeExecutableWindows,
+  getChromeWebSocketUrl,
   isChromeCdpReady,
   isChromeReachable,
   resolveBrowserExecutableForPlatform,
@@ -328,6 +330,39 @@ describe("browser chrome helpers", () => {
     expect(fetchSpy).not.toHaveBeenCalled();
   });
 
+  it("blocks cross-host websocket pivots returned by /json/version in strict SSRF mode", async () => {
+    const server = createServer((req, res) => {
+      if (req.url === "/json/version") {
+        res.writeHead(200, { "Content-Type": "application/json" });
+        res.end(
+          JSON.stringify({
+            webSocketDebuggerUrl: "ws://169.254.169.254:9222/devtools/browser/pivot",
+          }),
+        );
+        return;
+      }
+      res.writeHead(404);
+      res.end();
+    });
+
+    await new Promise<void>((resolve, reject) => {
+      server.listen(0, "127.0.0.1", () => resolve());
+      server.once("error", reject);
+    });
+
+    try {
+      const addr = server.address() as AddressInfo;
+      await expect(
+        getChromeWebSocketUrl(`http://127.0.0.1:${addr.port}`, 50, {
+          dangerouslyAllowPrivateNetwork: false,
+          allowedHostnames: ["127.0.0.1"],
+        }),
+      ).rejects.toBeInstanceOf(SsrFBlockedError);
+    } finally {
+      await new Promise<void>((resolve) => server.close(() => resolve()));
+    }
+  });
+
   it("reports cdpReady only when Browser.getVersion command succeeds", async () => {
     await withMockChromeCdpServer({
       wsPath: "/devtools/browser/health",
diff --git a/extensions/browser/src/browser/chrome.ts b/extensions/browser/src/browser/chrome.ts
@@ -200,7 +200,9 @@ export async function getChromeWebSocketUrl(
   if (!wsUrl) {
     return null;
   }
-  return normalizeCdpWsUrl(wsUrl, cdpUrl);
+  const normalizedWsUrl = normalizeCdpWsUrl(wsUrl, cdpUrl);
+  await assertCdpEndpointAllowed(normalizedWsUrl, ssrfPolicy);
+  return normalizedWsUrl;
 }
 
 async function canRunCdpHealthCommand(

Original file line number	Diff line number	Diff line change
`@@ -1,6 +1,7 @@`
`1`	`1`	`import type { SsrFPolicy } from "../infra/net/ssrf.js";`
`2`	`2`	`import {`
`3`	`3`	`appendCdpPath,`
	`4`	`+ assertCdpEndpointAllowed,`
`4`	`5`	`fetchJson,`
`5`	`6`	`isLoopbackHost,`
`6`	`7`	`isWebSocketUrl,`
`@@ -194,6 +195,7 @@ export async function createTargetViaCdp(opts: {`
`194`	`195`	`if (!wsUrl) {`
`195`	`196`	`throw new Error("CDP /json/version missing webSocketDebuggerUrl");`
`196`	`197`	`}`
	`198`	`+ await assertCdpEndpointAllowed(wsUrl, opts.ssrfPolicy);`
`197`	`199`	`}`
`198`	`200`
`199`	`201`	`return await withCdpSocket(wsUrl, async (send) => {`
Original file line number	Diff line number	Diff line change
`@@ -200,7 +200,9 @@ export async function getChromeWebSocketUrl(`
`200`	`200`	`if (!wsUrl) {`
`201`	`201`	`return null;`
`202`	`202`	`}`
`203`		`- return normalizeCdpWsUrl(wsUrl, cdpUrl);`
	`203`	`+ const normalizedWsUrl = normalizeCdpWsUrl(wsUrl, cdpUrl);`
	`204`	`+ await assertCdpEndpointAllowed(normalizedWsUrl, ssrfPolicy);`
	`205`	`+ return normalizedWsUrl;`
`204`	`206`	`}`
`205`	`207`
`206`	`208`	`async function canRunCdpHealthCommand(`