Repository navigation
#176 follow-ups: remaining special ranges, Proxy-Authorization/custom auth stripping, env list gaps + single-source (blocks network/env live runs) #177
Description
From Lain's #176 review. Items 1-3 must land before any live run with network or process:env grants.
- Range gaps a name grant can still reach: CGNAT 100.64/10, 0/8, broadcast, IPv4-compatible ::a.b.c.d, 64:ff9b:1::/48, 6to4 and Teredo embeddings, 198.18/15, 192.0.0/24, fec0::/10. Use one shared prefix table across all three backends.
- Cross-origin redirects strip only Authorization and Cookie; Proxy-Authorization and custom auth headers survive.
- Env refusal list misses GOFLAGS, GODEBUG, JAVA_TOOL_OPTIONS, PYTHONHOME, PERLLIB, GCONV_PATH, NODE_EXTRA_CA_CERTS, and is duplicated in three files. Single-source it and add a parity test.
- Pin the localhost opt-out to loopback addresses only.
Activity
howlcipher commentedon Oct 13, 2026
Additional items from Motoko's #176 review: also cover 240/4; env gaps GIT_*, PERL5DB, SHELLOPTS/PS4 (or move to an env allow-list); refuse a username and password in redirect targets. Suggested approach for the ranges: deny anything that isn't global unicast and decode embedded IPv4.
howlcipher commentedon Oct 13, 2026
Remaining after #176 (special ranges mostly done there). From Motoko's re-review:
capability/gogen/js: single-source process:env refusal tables (GIT_*,…
capability/gogen/js: decode IPv4-translated ::ffff:0:0/96; add 3fff::…
capability/gogen/js: pin localhost opt-out to loopback; Node pins and…
capability/gogen/js: strip all but shared safe headers on origin chan…
js: treat [::ffff:a.b.c.d] as a.b.c.d like core and generated Go; cro…
docs: changelog, authority references and journal for #177 and #175
Network/env follow-ups (#177) and runner-owned adapter deadline (#175) (