Fix: DNS rebinding TOCTOU in safeFetch (#405) by advancedresearcharray · Pull Request #538 · clawwork-ai/ClawWork

advancedresearcharray · 2026-06-13T16:21:34Z

Summary

Closes #405.

assertNotPrivateHost: throw SSRF blocked: DNS resolution failed when hostname DNS lookup fails or returns no addresses, instead of returning null and letting net.fetch re-resolve independently (DNS rebinding TOCTOU).
safeFetch: fire-and-forget reader.cancel() when streaming past maxSize so a slow cancel cannot delay the error.
Tests: regression coverage for DNS failure, empty lookup results, exact maxSize bodies, and bounded streaming.

Root cause

When the SSRF guard DNS lookup failed or returned no addresses, assertNotPrivateHost returned null. safeFetch then called net.fetch with the original hostname, which performs its own DNS resolution — reopening the TOCTOU window between the guard check and the actual fetch.

Test plan

vitest run test/ssrf-guard.test.ts test/safe-fetch.test.ts — 97 tests pass

github-actions · 2026-06-13T16:21:42Z

Hi @advancedresearcharray,
Thanks for your pull request!
If the PR is ready, use the /auto-cc command to assign Reviewer to Review.
We will review it shortly.

Details

Instructions for interacting with me using comments are available here.
If you have questions or suggestions related to my behavior, please file an issue against the gh-ci-bot repository.

gemini-code-assist · 2026-06-13T16:25:16Z

Summary of Changes

Hello, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request addresses a security vulnerability related to DNS rebinding in the safeFetch utility. By ensuring that DNS resolution results are strictly enforced and preventing re-resolution by the underlying fetch implementation, the change closes a Time-of-Check to Time-of-Use (TOCTOU) window. Additionally, it enhances resource management by ensuring that streams are properly cancelled and aborted when they exceed defined size limits.

Highlights

DNS Rebinding Mitigation: Updated assertNotPrivateHost to throw an error instead of returning null when DNS resolution fails or returns no addresses, preventing the net.fetch call from re-resolving the hostname and opening a TOCTOU window.
IPv6 Formatting: Added formatPinnedHostname to correctly wrap IPv6 addresses in brackets when rewriting URLs for pinned DNS.
Streaming Resource Management: Improved safeFetch to cancel the response body reader and abort the fetch signal immediately when the response size exceeds the configured limit, preventing unnecessary data consumption.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	`/gemini review`	Performs a code review for the current pull request in its current state.
Pull Request Summary	`/gemini summary`	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	`/gemini help`	Displays a list of available commands.

Customization

To customize the Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counterproductive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here.

Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

gemini-code-assist

Code Review

This pull request enhances SSRF protection and stream handling in safe-fetch.ts and ssrf-guard.ts. Specifically, it correctly formats pinned IPv6 hostnames with brackets, throws an error when DNS resolution fails to prevent TOCTOU vulnerabilities, and cancels the stream reader when the response size exceeds maxSize. The feedback suggests avoiding awaiting reader.cancel() to prevent blocking or delaying the 'response too large' error.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

gemini-code-assist · 2026-06-13T16:26:11Z

      if (done) break;
      total += value.byteLength;
      if (total > maxSize) {
+        await reader.cancel().catch(() => undefined);


Awaiting reader.cancel() here can block the execution and delay throwing the 'response too large' error (or even hang indefinitely if the stream's cancel promise hangs). Since we are already aborting the controller and throwing an error, we can trigger the cancellation in the background without awaiting it.

Suggested change

await reader.cancel().catch(() => undefined);

reader.cancel().catch(() => undefined);

advancedresearcharray · 2026-06-13T16:34:17Z

Addressed review feedback in 361dd9c: reader.cancel() is now fire-and-forget (not awaited) when rejecting oversized streams, so a slow/hanging cancel cannot delay the `response too large` error.

Verified locally: `vitest run test/ssrf-guard.test.ts test/safe-fetch.test.ts` — 97 tests pass.

Do not await reader.cancel() when rejecting oversized streams; abort the fetch and throw immediately so a slow cancel cannot delay the error. Add regression test for bodies exactly at maxSize. Co-authored-by: Cursor <cursoragent@cursor.com>

…ai#405) Tighten SSRF guard regression tests to match the thrown error string when hostname lookup fails or returns no addresses. Co-authored-by: Cursor <cursoragent@cursor.com>

advancedresearcharray · 2026-06-27T08:37:18Z

This PR is ready for merge. CI is green, and there are no outstanding review comments.

advancedresearcharray · 2026-06-27T11:52:28Z

This PR is ready to be merged! 🚀

Please review and merge when convenient. 😊

advancedresearcharray · 2026-06-27T18:22:40Z

DNS rebinding TOCTOU fix is ready to merge. CI is green, and no further action required.

advancedresearcharray · 2026-06-28T00:38:08Z

PR looks good! Ready for merge.

advancedresearcharray requested review from HiddenPuppy, mvanhorn and samzong as code owners June 13, 2026 16:21

gemini-code-assist Bot reviewed Jun 13, 2026

View reviewed changes

advancedresearcharray and others added 2 commits June 15, 2026 05:53

test(desktop): assert exact DNS resolution failure message (clawwork-…

e9fdb0c

…ai#405) Tighten SSRF guard regression tests to match the thrown error string when hostname lookup fails or returns no addresses. Co-authored-by: Cursor <cursoragent@cursor.com>

advancedresearcharray force-pushed the fix/405-safe-fetch-dns-rebinding-toctou branch from 352d638 to e9fdb0c Compare June 15, 2026 14:54

style(desktop): fix prettier formatting in ssrf-guard tests

de4c712

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Fix: DNS rebinding TOCTOU in safeFetch (#405)#538

Fix: DNS rebinding TOCTOU in safeFetch (#405)#538
advancedresearcharray wants to merge 3 commits into
clawwork-ai:mainfrom
advancedresearcharray:fix/405-safe-fetch-dns-rebinding-toctou

advancedresearcharray commented Jun 13, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Jun 13, 2026

Uh oh!

gemini-code-assist Bot commented Jun 13, 2026

Uh oh!

gemini-code-assist Bot left a comment

Uh oh!

gemini-code-assist Bot Jun 13, 2026

Uh oh!

advancedresearcharray commented Jun 13, 2026

Uh oh!

advancedresearcharray commented Jun 27, 2026

Uh oh!

advancedresearcharray commented Jun 27, 2026

Uh oh!

advancedresearcharray commented Jun 27, 2026

Uh oh!

advancedresearcharray commented Jun 28, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

	await reader.cancel().catch(() => undefined);
	reader.cancel().catch(() => undefined);

Uh oh!

Conversation

advancedresearcharray commented Jun 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Root cause

Test plan

Uh oh!

github-actions Bot commented Jun 13, 2026

Uh oh!

gemini-code-assist Bot commented Jun 13, 2026

Summary of Changes

Highlights

Footnotes

Uh oh!

gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

gemini-code-assist Bot Jun 13, 2026

Choose a reason for hiding this comment

Uh oh!

advancedresearcharray commented Jun 13, 2026

Uh oh!

advancedresearcharray commented Jun 27, 2026

Uh oh!

advancedresearcharray commented Jun 27, 2026

Uh oh!

advancedresearcharray commented Jun 27, 2026

Uh oh!

advancedresearcharray commented Jun 28, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

advancedresearcharray commented Jun 13, 2026 •

edited

Loading