Skip to content

listenHTTP: bind to the given host, localhost by default - #199

Merged
filippi merged 2 commits into
forefireAPI:masterfrom
antonio-leblanc:fix/http-server-hardening
Oct 21, 2026
Merged

filippi merged 2 commits into
forefireAPI:masterfrom
antonio-leblanc:fix/http-server-hardening

Conversation

@antonio-leblanc

Copy link
Copy Markdown
Collaborator

listenHTTP[] now binds to localhost by default and to the host given in listenHTTP[host:port]; any other interface prints a warning, and listenHTTP[0.0.0.0:8000] restores the old behaviour. systemExec is refused over HTTP, and the file server no longer follows .. or absolute paths. listenHTTP[host=127.0.0.1:8080] (used in tests/mnh_real_nested) keeps working.

Reported by @HugoFara.

Warn when the server is reachable from the network, refuse systemExec
over HTTP, and keep the file server out of .. and absolute paths.

Reported by @HugoFara.
Check in systemExec itself, so include[] and @t= events scheduled over
HTTP are covered too.
@antonio-leblanc

Copy link
Copy Markdown
Collaborator Author
image Also adding a warning

@filippi filippi left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

good ! was fun to kaunch command from the bronwser but yes, very unsafe

@filippi
filippi merged commit ad8aed0 into forefireAPI:master Oct 21, 2026
8 checks passed
@HugoFara

Copy link
Copy Markdown
Collaborator

There are still other issues to solve with the HTTP, I sent them to Antonio, such as the Docker is being currently bricked. WASM is probably the safe path for browser-based interactions, as it wouldn't open any port.

filippi pushed a commit that referenced this pull request Oct 21, 2026
Bind inside Docker with listenHTTP[0.0.0.0:8000] in the docs, treat an
empty host as localhost, write the real hostname to httpConnectInfo.txt
on 0.0.0.0, close the socket when bind fails, restore remoteCommand and
cout on exceptions, and refuse commands from another site or host name.

Thanks @HugoFara for the review.
antonio-leblanc added a commit that referenced this pull request Oct 21, 2026
# Conflicts:
#	CHANGELOG.md
#	src/Command.cpp
#	src/Command.h
antonio-leblanc added a commit that referenced this pull request Oct 21, 2026
@antonio-leblanc
antonio-leblanc deleted the fix/http-server-hardening branch October 23, 2026 12:38
@antonio-leblanc antonio-leblanc added this to the Security posture milestone Oct 28, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants