Merge branch 'main' into rama-integration-beta

packages/safe-chain/src/registryProxy/builtInProxy/createBuiltInProxyServer.js

@@ -48,8 +48,11 @@ export function createBuiltInProxyServer() {
    */
   function startServer(server) {
     return new Promise((resolve, reject) => {
-      // Passing port 0 makes the OS assign an available port
-      server.listen(0, () => {
+      // Bind to loopback only. Without an explicit host, Node listens on every
+      // interface, turning the proxy into an unauthenticated forward proxy that
+      // anyone reachable on the network can use to hit the victim's localhost,
+      // intranet, or cloud metadata endpoints. Port 0 lets the OS pick a port.
+      server.listen(0, "127.0.0.1", () => {
         const address = server.address();
         if (address && typeof address === "object") {
           state.port = address.port;

packages/safe-chain/src/registryProxy/registryProxy.js

@@ -55,7 +55,7 @@ export function getProxySettings() {
     };
   }
 
-  const proxyUrl = `http://localhost:${server.getServerPort()}`;
+  const proxyUrl = `http://127.0.0.1:${server.getServerPort()}`;
   const caCert = server.getCaCert();
   const caCertBundlePath = getCombinedCaBundlePath(caCert);
 

packages/safe-chain/src/registryProxy/registryProxy.loopback.spec.js

@@ -0,0 +1,67 @@
+import { before, after, describe, it } from "node:test";
+import assert from "node:assert";
+import net from "node:net";
+import os from "node:os";
+import {
+  createSafeChainProxy,
+  mergeSafeChainProxyEnvironmentVariables,
+} from "./registryProxy.js";
+
+describe("registryProxy loopback binding", () => {
+  let proxy, proxyPort;
+
+  before(async () => {
+    proxy = createSafeChainProxy();
+    await proxy.startServer();
+    const envVars = mergeSafeChainProxyEnvironmentVariables([]);
+    proxyPort = parseInt(new URL(envVars.HTTPS_PROXY).port, 10);
+  });
+
+  after(async () => {
+    await proxy.stopServer();
+  });
+
+  it("advertises a loopback HTTPS_PROXY URL", () => {
+    const envVars = mergeSafeChainProxyEnvironmentVariables([]);
+    const hostname = new URL(envVars.HTTPS_PROXY).hostname;
+    assert.ok(
+      hostname === "127.0.0.1" || hostname === "::1" || hostname === "localhost",
+      `expected loopback hostname, got ${hostname}`
+    );
+  });
+
+  it("refuses connections on non-loopback interfaces", async () => {
+    const externalAddrs = Object.values(os.networkInterfaces())
+      .flat()
+      .filter((iface) => iface && iface.family === "IPv4" && !iface.internal)
+      .map((iface) => iface.address);
+
+    if (externalAddrs.length === 0) {
+      // No non-loopback interface available (e.g. locked-down CI) - skip.
+      return;
+    }
+
+    for (const addr of externalAddrs) {
+      await new Promise((resolve, reject) => {
+        const sock = net.createConnection({ host: addr, port: proxyPort });
+        const timer = setTimeout(() => {
+          sock.destroy();
+          resolve(); // Filtered / dropped is also fine - we just don't want success.
+        }, 500);
+        sock.once("connect", () => {
+          clearTimeout(timer);
+          sock.destroy();
+          reject(
+            new Error(
+              `proxy accepted a connection on non-loopback ${addr}:${proxyPort}`
+            )
+          );
+        });
+        sock.once("error", () => {
+          clearTimeout(timer);
+          resolve();
+        });
+      });
+    }
+  });
+});