fix(codex): guard loopback WS classification with isIP to prevent DNS hostname bypass

lsr911 · claude · lsr911 · commit cab3336eda41 · 2026-07-18T20:20:36.000+08:00
The remote-auth boundary in assertCodexAppServerConnectionSecurity uses
isLoopbackWebSocketUrl to classify WS transports as local-loopback
(auth-free) vs remote (requires authToken/Authorization). Before this
fix, host.startsWith("127.") matched DNS hostnames like 127.evil.com,
letting a remote WebSocket endpoint skip authentication entirely.

Add isIP(host)===4 guard so only literal IPv4 loopback addresses qualify.
Same canonical pattern as extensions/slack/src/monitor/relay-source.ts:271.

Co-Authored-By: Claude &lt;noreply@anthropic.com&gt;
diff --git a/extensions/codex/src/app-server/config.ts b/extensions/codex/src/app-server/config.ts
@@ -1,6 +1,7 @@
 // Codex helper module supports config behavior.
 import { createHash, createHmac, randomBytes } from "node:crypto";
 import { readFileSync } from "node:fs";
+import { isIP } from "node:net";
 import { homedir as readHomeDir, hostname as readHostName } from "node:os";
 import path from "node:path";
 import {
@@ -1344,7 +1345,10 @@ function isLoopbackWebSocketUrl(value: string): boolean {
     host === "127.0.0.1" ||
     host === "::1" ||
     host === "[::1]" ||
-    host.startsWith("127.")
+    // Guard with isIP so DNS hostnames like 127.evil.com don't bypass
+    // the remote-auth boundary — only literal IPv4 loopback addresses
+    // starting with 127. qualify.
+    (isIP(host) === 4 && host.startsWith("127."))
   );
 }
 
diff --git a/extensions/codex/src/app-server/loopback-ws-auth.test.ts b/extensions/codex/src/app-server/loopback-ws-auth.test.ts
@@ -0,0 +1,110 @@
+// Covers DNS hostname bypass of the remote-auth WS loopback boundary.
+// Fix: guard `host.startsWith("127.")` with `isIP(host) === 4` so
+// hostnames like `127.evil.com` don't skip authToken/Authorization.
+import { describe, expect, it } from "vitest";
+
+// Reach into config.ts for the internal helper; test through its canonical
+// consumer `assertCodexAppServerConnectionSecurity` where possible.
+const { assertCodexAppServerConnectionSecurity } = await import("./config.js");
+
+describe("isLoopbackWebSocketUrl (via assertCodexAppServerConnectionSecurity)", () => {
+  it("rejects DNS hostnames that start with 127.", () => {
+    // DNS hostnames must NOT bypass the remote-auth boundary.
+    // Before the fix, host.startsWith("127.") classified these as loopback.
+    expect(() =>
+      assertCodexAppServerConnectionSecurity({
+        transport: "websocket",
+        url: "ws://127.evil.com/app",
+        authToken: undefined,
+        headers: {},
+      }),
+    ).toThrow(/remote Codex app-server WebSocket URLs require/);
+    expect(() =>
+      assertCodexAppServerConnectionSecurity({
+        transport: "websocket",
+        url: "wss://127.example.com/codex",
+        authToken: undefined,
+        headers: {},
+      }),
+    ).toThrow(/remote Codex app-server WebSocket URLs require/);
+  });
+
+  it("rejects DNS hostnames with a 127-like subdomain", () => {
+    expect(() =>
+      assertCodexAppServerConnectionSecurity({
+        transport: "websocket",
+        url: "wss://ws.127.com/codex",
+        authToken: undefined,
+        headers: {},
+      }),
+    ).toThrow(/remote Codex app-server WebSocket URLs require/);
+  });
+
+  it("still classifies literal 127/8 IPv4 as loopback", () => {
+    // Valid IPv4 loopback addresses must still skip auth.
+    expect(() =>
+      assertCodexAppServerConnectionSecurity({
+        transport: "websocket",
+        url: "ws://127.0.0.1:3333/app",
+        authToken: undefined,
+        headers: {},
+      }),
+    ).not.toThrow();
+    expect(() =>
+      assertCodexAppServerConnectionSecurity({
+        transport: "websocket",
+        url: "ws://127.255.255.254/codex",
+        authToken: undefined,
+        headers: {},
+      }),
+    ).not.toThrow();
+  });
+
+  it("still classifies localhost and ::1 as loopback", () => {
+    expect(() =>
+      assertCodexAppServerConnectionSecurity({
+        transport: "websocket",
+        url: "ws://localhost:3333/app",
+        authToken: undefined,
+        headers: {},
+      }),
+    ).not.toThrow();
+    expect(() =>
+      assertCodexAppServerConnectionSecurity({
+        transport: "websocket",
+        url: "ws://[::1]:3333/app",
+        authToken: undefined,
+        headers: {},
+      }),
+    ).not.toThrow();
+  });
+
+  it("does not throw for non-WS transports (they are always local-loopback)", () => {
+    // Non-websocket transports bypass the WS URL check entirely.
+    expect(() =>
+      assertCodexAppServerConnectionSecurity({
+        transport: "stdio",
+        authToken: undefined,
+        headers: {},
+      }),
+    ).not.toThrow();
+  });
+
+  it("does not throw for remote WS with valid auth", () => {
+    expect(() =>
+      assertCodexAppServerConnectionSecurity({
+        transport: "websocket",
+        url: "wss://remote.example.com/codex",
+        authToken: "secret",
+        headers: {},
+      }),
+    ).not.toThrow();
+    expect(() =>
+      assertCodexAppServerConnectionSecurity({
+        transport: "websocket",
+        url: "ws://remote.example.com/codex",
+        headers: { authorization: "Bearer token" },
+      }),
+    ).not.toThrow();
+  });
+});
