mirror of
https://github.com/MoonshotAI/kimi-code.git
synced 2026-08-25 08:34:39 +00:00
31449728b7
Some checks are pending
Nix Build / nix build .#kimi-code (push) Blocked by required conditions
Release / Desktop release artifact (push) Blocked by required conditions
Release / Release (push) Waiting to run
Release / Deploy docs (push) Blocked by required conditions
Release / Publish native release assets (push) Blocked by required conditions
CI / test-pi-tui (push) Waiting to run
CI / test-windows (push) Waiting to run
CI / lint (push) Waiting to run
CI / build (push) Waiting to run
CI / VSIX package audit (darwin-arm64) (push) Waiting to run
CI / VSIX package audit (all) (push) Waiting to run
CI / VSIX package audit (win32-x64) (push) Waiting to run
CI / test (1) (push) Waiting to run
CI / test (2) (push) Waiting to run
CI / test (3) (push) Waiting to run
CI / test (4) (push) Waiting to run
CI / test (5) (push) Waiting to run
CI / typecheck (push) Waiting to run
Nix Build / Check flake.nix workspace sync (push) Waiting to run
Release / Native release artifact (push) Blocked by required conditions
* fix(security): close FetchURL SSRF bypasses and DNS-rebinding window - resolve hostnames via DNS and reject any target resolving to loopback / RFC1918 / link-local / CGNAT / ULA ranges, including IPv4-mapped IPv6 forms (e.g. localtest.me, [::ffff:7f00:1]) — the static host denylist only matched literals and could be bypassed by crafted domains - follow redirects manually with full per-hop revalidation (10-hop cap) instead of auto-following, so a public URL cannot 302 the fetcher at internal services or cloud metadata endpoints - pin each connection to the DNS answers the check validated (per-hop undici Agent with a pinned lookup), closing the TOCTOU / DNS-rebinding window between the check and the connect; skipped when a proxy is configured or allowPrivateAddresses is set - apply to both agent-core and agent-core-v2 providers, with SSRF / redirect / pinning test coverage * chore: add changeset for FetchURL SSRF hardening * test: bridge undici type declarations in fetch pinning tests * fix(security): keep dispatcher option lib-agnostic for DOM typecheck consumers * fix(security): address review — pin NO_PROXY bypasses, drain oversized bodies, header-only comments |
||
|---|---|---|
| .. | ||
| acp-adapter | ||
| agent-core | ||
| agent-core-v2 | ||
| kaos | ||
| kap-server | ||
| klient | ||
| kosong | ||
| migration-legacy | ||
| minidb | ||
| node-sdk | ||
| oauth | ||
| pi-tui | ||
| protocol | ||
| telemetry | ||