mirror of
https://github.com/danny-avila/LibreChat.git
synced 2026-05-13 16:07:30 +00:00
🪟 feat: Add allowedAddresses Exemption List For SSRF-Guarded Targets (#12933)
* 🪟 feat: Add allowedAddresses Exemption List For SSRF-Guarded Targets LibreChat already blocks SSRF-prone targets (private IPs, loopback, link-local, .internal/.local TLDs) at every server-side fetch site that consumes user-controllable URLs — custom-endpoint baseURLs, MCP servers, OpenAPI Actions, and OAuth endpoints. The only existing escape hatch is `allowedDomains`, but that flips the field into a strict whitelist: adding `127.0.0.1` to permit a self-hosted Ollama also blocks every public destination that isn't in the list. Introduce `allowedAddresses` as the orthogonal primitive: a private- IP-space exemption list. When a hostname or its resolved IP appears in the list, the SSRF block is bypassed for that target. Public destinations remain reachable. Operators can now run self-hosted LLMs / MCP servers / Action endpoints on private addresses without weakening the default-deny posture for everything else. Schema additions in `packages/data-provider/src/config.ts`: - `endpoints.allowedAddresses` (new — gates `validateEndpointURL`) - `mcpSettings.allowedAddresses` (parallel to `allowedDomains`) - `actions.allowedAddresses` (parallel to `allowedDomains`) Core changes in `packages/api/src/auth/`: - New `isAddressAllowed(hostnameOrIP, allowedAddresses)` — pure, case-insensitive, bracket-stripped literal match. - Threaded the list through `isSSRFTarget`, `resolveHostnameSSRF`, `isDomainAllowedCore`, `isActionDomainAllowed`, `isMCPDomainAllowed`, `isOAuthUrlAllowed`, and `validateEndpointURL`. - Extended `createSSRFSafeAgents` and `createSSRFSafeUndiciConnect` to accept the list, building an SSRF-safe DNS lookup that exempts matching hostnames/IPs at TCP connect time (TOCTOU-safe). Wiring: - Custom and OpenAI endpoint initialize sites pass `endpoints.allowedAddresses` to `validateEndpointURL`. - `MCPServersRegistry` stores `allowedAddresses` and exposes it via `getAllowedAddresses()`. The factory, connection class, manager, `UserConnectionManager`, and `ConnectionsRepository` all thread it through to the SSRF utilities. - `MCPOAuthHandler.initiateOAuthFlow`, `refreshOAuthTokens`, and `validateOAuthUrl` accept the list and consult it on every URL validation along the OAuth chain. - `ToolService`, `ActionService`, and the assistants/agents action routes pass `actions.allowedAddresses` to `isActionDomainAllowed` and to `createSSRFSafeAgents` for runtime action calls. - `initializeMCPs.js` reads `mcpSettings.allowedAddresses` from the app config and forwards it to the registry constructor. Documentation: - `librechat.example.yaml` shows the new field next to each existing `allowedDomains` block, with a note clarifying that `allowedAddresses` is an exemption list (not a whitelist). Tests: - Unit tests for `isAddressAllowed` covering literal IPs, hostnames, IPv6 brackets, case insensitivity, and partial-match rejection. - Exemption tests for every entry point: `isSSRFTarget`, `resolveHostnameSSRF`, `validateEndpointURL`, `isActionDomainAllowed`, `isMCPDomainAllowed`, `isOAuthUrlAllowed`. - Existing tests updated to reflect the new optional parameter. Default behavior is unchanged: omitted = empty list = no exemptions. * 🩹 fix: Plumb allowedAddresses Through AppConfig endpoints Type The initial PR added `endpoints.allowedAddresses` to the data-provider config schema and consumed it in the endpoint initialize sites, but the runtime `AppConfig.endpoints` shape in `@librechat/data-schemas` was a hand-maintained subset that didn't include the new field — so `tsc` rejected `appConfig.endpoints.allowedAddresses`. Add the field to `AppConfig['endpoints']` in `packages/data-schemas/src/types/app.ts` and forward it from the loaded config in `packages/data-schemas/src/app/endpoints.ts` so the runtime config carries the value. Update `initializeMCPs.spec.js` to expect the third positional argument (`allowedAddresses`) on the `createMCPServersRegistry` call. * 🩹 fix: Enforce allowedDomains Before allowedAddresses In isOAuthUrlAllowed The initial implementation checked the address exemption first, so a URL whose hostname appeared in `allowedAddresses` would return true even when the admin had configured `allowedDomains` as a strict bound on OAuth endpoints. A malicious MCP server could advertise OAuth metadata, token, or revocation URLs at any address the admin had permitted for an unrelated reason (a self-hosted LLM at `127.0.0.1`, for example) and pass validation, expanding SSRF reach beyond the configured domain whitelist. Reorder: when `allowedDomains` is set, treat it as authoritative — return true only if the URL matches a domain entry, otherwise fall through to false. The address exemption only applies when no `allowedDomains` is configured (mirrors how the downstream SSRF check in `validateOAuthUrl` consults `allowedAddresses`). Add a regression test asserting that an `allowedAddresses` entry does not broaden a configured `allowedDomains` list. Reported by chatgpt-codex-connector on PR #12933. * 🩹 fix: Forward allowedAddresses To Remaining OAuth Callers Two `MCPOAuthHandler` callers still used the pre-feature signatures and were silently dropping the new `allowedAddresses` argument: - `api/server/routes/mcp.js` invoked `initiateOAuthFlow` with the old 5-argument shape, so OAuth flows initiated through the route handler ignored the registry's `getAllowedAddresses()` and would reject any metadata/authorization/token URL on a permitted private host. - `api/server/controllers/UserController.js#maybeUninstallOAuthMCP` invoked `revokeOAuthToken` without the address exemption, so uninstalling an OAuth-backed MCP server on a permitted private host would fail at the revocation step even though the rest of the MCP connection path now permits it. Both sites now read `allowedAddresses` from the registry alongside `allowedDomains` and forward it. Reported by Copilot on PR #12933. * 🩹 fix: Update Test Mocks And Assertions For OAuth allowedAddresses The previous commit started passing `allowedAddresses` to `MCPOAuthHandler.initiateOAuthFlow` from `api/server/routes/mcp.js` and to `MCPOAuthHandler.revokeOAuthToken` from `api/server/controllers/UserController.js`, but the corresponding test files mocked the registry without `getAllowedAddresses` (causing `TypeError`s) and asserted the old positional shape on `toHaveBeenCalledWith`. Update the mocks and assertions to match the new arity: - `api/server/routes/__tests__/mcp.spec.js`: add `getAllowedDomains`/`getAllowedAddresses` to the registry mock and expect the additional positional args on `initiateOAuthFlow`. - `api/server/controllers/__tests__/maybeUninstallOAuthMCP.spec.js`: add a `getAllowedAddresses` mock alongside the existing `getAllowedDomains` and seed it in `setupOAuthServerFound`. - `api/server/controllers/__tests__/UserController.mcpOAuth.spec.js`: add `getAllowedAddresses` to the registry mock and expect the trailing `null` arg on the three `revokeOAuthToken` assertions. * 🛡️ fix: Address Comprehensive Review — Scope allowedAddresses To Private IP Space Major findings from the comprehensive PR review (severity → fix): **CRITICAL — `validateOAuthUrl` SSRF fallback bypass.** When `allowedDomains` is configured and a URL fails the whitelist, the SSRF fallback in `validateOAuthUrl` was still passing `allowedAddresses` to `isSSRFTarget` / `resolveHostnameSSRF`, letting a malicious MCP server advertise OAuth endpoints at any address the admin had permitted for an unrelated reason. Suppress `allowedAddresses` in the fallback when `allowedDomains` is active — the address exemption is opt-in for the no-whitelist mode only. **MAJOR — WebSocket transport SSRF check ignored exemptions.** The `constructTransport` WebSocket branch called `resolveHostnameSSRF(wsHostname)` without `this.allowedAddresses`, so a permitted private MCP server would pass `isMCPDomainAllowed` but be blocked at transport creation. Forward the exemption. **Scope `allowedAddresses` to private IP space only (operator directive).** The exemption list is for permitting private/internal targets; it must not be a back-door to broaden trust to public destinations. - Schema (`packages/data-provider/src/config.ts`): new `allowedAddressesSchema` rejects URLs (`://`), paths/CIDR (`/`), whitespace, and public IPv4/IPv6 literals at config-load time. Wired into `endpoints`, `mcpSettings`, and `actions`. - Runtime (`packages/api/src/auth/domain.ts`): `isAddressAllowed` now drops public-IP candidates and public-IP entries on the match path — defense in depth so a misconfigured runtime list never grants exemption. - Hot path (`packages/api/src/auth/agent.ts`): `buildSSRFSafeLookup` pre-normalizes the list into a `Set<string>` once at construction and applies the same scoping filter, so the connect-time DNS lookup is an O(1) Set membership check instead of a full re-iterate-and-normalize on every outbound request. **Test coverage for the connect-time and OAuth-fallback paths.** - `agent.spec.ts`: new describe block exercising `buildSSRFSafeLookup` and `createSSRFSafe*` with `allowedAddresses` — hostname-literal exemption, resolved-IP exemption, public-IP scoping, URL/CIDR/whitespace rejection, and the default no-list block. - `handler.allowedAddresses.test.ts` (new): integration tests for `validateOAuthUrl` — covers both the no-domains-set "permit private" path and the strict-bound regression where `allowedAddresses` must NOT bypass `allowedDomains`. **Documentation & cleanup.** - `connection.ts` redirect SSRF check: explicit comment that `allowedAddresses` is intentionally NOT consulted for redirect targets (server-controlled, must not inherit the admin's exemption). - `MCPConnectionFactory.test.ts`: replaced an `eslint-disable` with a proper `import { getTenantId } from '@librechat/data-schemas'`. The disable was added to make a pre-existing `require()` quiet — the cleaner fix is to use the existing top-level import. Updated `MCPConnectionSSRF.test.ts` WebSocket SSRF assertions to match the new two-argument call shape (`hostname, allowedAddresses`). * 🩹 fix: Require Absolute URL Before allowedAddresses Trust Bypass In isOAuthUrlAllowed `parseDomainSpec` is lenient — it silently prepends `https://` to schemeless inputs so it can match patterns like bare `example.com`. That leniency leaked into `isOAuthUrlAllowed`'s new `allowedAddresses` short-circuit: a value like `10.0.0.5/oauth` (no scheme) would parse successfully via the prepended default, hit the address-exemption path, return `true`, and skip `validateOAuthUrl`'s strict `new URL(url)` parse-or-throw — only to fail later in OAuth discovery with a less clear runtime error. Add a strict `new URL(url)` gate at the top of `isOAuthUrlAllowed`. Schemeless inputs now fall through to `validateOAuthUrl`'s explicit "Invalid OAuth <field>" rejection. Tests added in both `auth/domain.spec.ts` (unit) and the OAuth handler integration spec (end-to-end). Reported by chatgpt-codex-connector (P2) on PR #12933. * 🛡️ fix: Address Follow-Up Comprehensive Review — Schema Tests, Shared Normalization, host:port Auditing the second comprehensive review: **F1 MAJOR — schema validation untested.** `allowedAddressesSchema` had zero coverage, so a regression in the three refinement stages or the three wiring locations (`endpoints` / `mcpSettings` / `actions`) would silently let invalid entries reach the runtime. Added a dedicated `describe('allowedAddressesSchema')` block in `config.spec.ts` covering: valid private IPs (v4 + v6, including the previously-missed 192.0.0.0/24 range), accepted hostnames, all rejection categories (URLs, CIDR, paths, whitespace tabs/newlines, host:port, public IP literals), and full `configSchema.parse()` integration at each of the three nesting points. **F2 MINOR — `isPrivateIPv4Literal` divergence.** The schema reimpl in `packages/data-provider` was discarding the `c` octet, so the `192.0.0.0/24` (RFC 5736 IETF protocol assignments) range that the authoritative `isPrivateIPv4` accepts was being rejected with a misleading "public IP" error. Destructure `c` and add the missing range check; covered by the new schema tests. **F3 MINOR — DRY violation across `domain.ts` and `agent.ts`.** Both files had independent normalization implementations with a subtle whitespace-check divergence (`/\s/` vs `.includes(' ')`). Extracted the shared logic into a new `packages/api/src/auth/allowedAddresses.ts` module that both consumers import: - `normalizeAddressEntry(entry)` — single-entry shape check - `looksLikeHostPort(entry)` — host:port detector (used by F4) - `normalizeAllowedAddressesSet(list)` — pre-normalized Set for the connect-time hot path - `isAddressInAllowedSet(candidate, set)` — membership check that enforces private-IP scoping on the candidate Both `isAddressAllowed` (preflight) and `buildSSRFSafeLookup` (connect) now go through the same primitives; the whitespace divergence is gone. To break the import cycle (`allowedAddresses` needs `isPrivateIP`, `domain` previously owned it), extracted IP private-range detection into a leaf `auth/ip.ts` module. `domain.ts` re-exports `isPrivateIP` for backward compatibility with existing call sites. **F4 MINOR — `host:port` silently misclassified.** Entries like `localhost:8080` previously slipped through the URL/path guard, were mis-detected as IPv6, failed `isPrivateIP`, and were silently dropped with a misleading "public IP" schema error. Added an explicit `looksLikeHostPort` check with a clear error: "allowedAddresses entries must not include a port — list the bare hostname or IP only." Bare `::1`, `[::1]`, and other valid IPv6 literals are intentionally not matched (regex distinguishes by colon count and the bracketed `[ipv6]:port` form). **F5 MINOR — hostname-trust documentation gap.** Hostname entries short-circuit `resolveHostnameSSRF` before any DNS lookup — that's a deliberate design (admin trusts the name) but it means the exemption follows whatever the name resolves to at runtime. Added an explicit note in `librechat.example.yaml` for both `mcpSettings.allowedAddresses` and `endpoints.allowedAddresses`: "a hostname entry trusts whatever IP that name resolves to. Only list hostnames whose DNS you control. Prefer literal IPs when you can." **F6** (8 positional params) is flagged for follow-up; refactor to an options object is a breaking-API change deferred to a separate PR. **F7** (redirect/WebSocket asymmetry, NIT, conf 40) — skipping; the existing inline comment is sufficient. * 🧹 chore: Address Follow-Up NITs — Import Order And Mirror-Function Naming Three NITs from the latest comprehensive review: **NIT #1 (conf 85) — local import order.** AGENTS.md requires local imports sorted longest-to-shortest. Both `domain.ts` and `agent.ts` had `./ip` (shorter) before `./allowedAddresses` (longer). Swapped. **NIT #2 (conf 60) — missing cross-reference.** The schema-side `isHostPortShape` in `packages/data-provider/src/config.ts` had no note pointing at the canonical runtime mirror. Added a JSDoc paragraph explaining the mirror relationship and why a local copy exists (the data-provider package can't import from `@librechat/api` without creating a circular dependency). **NIT #3 (conf 50) — naming inconsistency.** Renamed `isHostPortShape` → `looksLikeHostPort` so the schema mirror matches the runtime helper exactly. Kept as a separate function (not a shared import) for the same circular-dependency reason; the matching name makes it obvious they should stay in lockstep.
This commit is contained in:
Danny Avila
GitHub
parent
85fa881e3c
commit
4cce88be42
45 changed files with 1377 additions and 222 deletions
|
|
@ -480,7 +480,9 @@ const maybeUninstallOAuthMCP = async (userId, pluginKey, appConfig) => {
|
|||
serverConfig.oauth?.revocation_endpoint_auth_methods_supported ??
|
||||
clientMetadata.revocation_endpoint_auth_methods_supported;
|
||||
const oauthHeaders = serverConfig.oauth_headers ?? {};
|
||||
const allowedDomains = getMCPServersRegistry().getAllowedDomains();
|
||||
const registry = getMCPServersRegistry();
|
||||
const allowedDomains = registry.getAllowedDomains();
|
||||
const allowedAddresses = registry.getAllowedAddresses();
|
||||
|
||||
if (tokens?.access_token) {
|
||||
try {
|
||||
|
|
@ -497,6 +499,7 @@ const maybeUninstallOAuthMCP = async (userId, pluginKey, appConfig) => {
|
|||
},
|
||||
oauthHeaders,
|
||||
allowedDomains,
|
||||
allowedAddresses,
|
||||
);
|
||||
} catch (error) {
|
||||
logger.error(
|
||||
|
|
@ -521,6 +524,7 @@ const maybeUninstallOAuthMCP = async (userId, pluginKey, appConfig) => {
|
|||
},
|
||||
oauthHeaders,
|
||||
allowedDomains,
|
||||
allowedAddresses,
|
||||
);
|
||||
} catch (error) {
|
||||
logger.error(
|
||||
|
|
|
|||
|
|
@ -121,6 +121,7 @@ function setupMCPMocks() {
|
|||
}),
|
||||
getOAuthServers: jest.fn().mockResolvedValue(new Set(['test-server'])),
|
||||
getAllowedDomains: jest.fn().mockReturnValue([]),
|
||||
getAllowedAddresses: jest.fn().mockReturnValue(null),
|
||||
};
|
||||
|
||||
mockGetAppConfig.mockResolvedValue({});
|
||||
|
|
@ -333,6 +334,7 @@ describe('updateUserPluginsController MCP OAuth cleanup', () => {
|
|||
},
|
||||
{},
|
||||
[],
|
||||
null,
|
||||
);
|
||||
expect(MCPOAuthHandler.revokeOAuthToken).toHaveBeenCalledWith(
|
||||
'test-server',
|
||||
|
|
@ -347,6 +349,7 @@ describe('updateUserPluginsController MCP OAuth cleanup', () => {
|
|||
},
|
||||
{},
|
||||
[],
|
||||
null,
|
||||
);
|
||||
expect(MCPTokenStorage.deleteUserTokens).toHaveBeenCalledWith({
|
||||
userId: 'user-1',
|
||||
|
|
@ -378,6 +381,7 @@ describe('updateUserPluginsController MCP OAuth cleanup', () => {
|
|||
expect.objectContaining({ clientId: 'client-1' }),
|
||||
{},
|
||||
[],
|
||||
null,
|
||||
);
|
||||
expect(MCPTokenStorage.deleteUserTokens).toHaveBeenCalledWith({
|
||||
userId: 'user-1',
|
||||
|
|
@ -409,6 +413,7 @@ describe('updateUserPluginsController MCP OAuth cleanup', () => {
|
|||
expect.objectContaining({ clientId: 'client-1' }),
|
||||
{},
|
||||
[],
|
||||
null,
|
||||
);
|
||||
expect(MCPTokenStorage.deleteUserTokens).toHaveBeenCalledWith({
|
||||
userId: 'user-1',
|
||||
|
|
|
|||
|
|
@ -5,6 +5,7 @@ const mockRevokeOAuthToken = jest.fn();
|
|||
const mockGetServerConfig = jest.fn();
|
||||
const mockGetOAuthServers = jest.fn();
|
||||
const mockGetAllowedDomains = jest.fn();
|
||||
const mockGetAllowedAddresses = jest.fn();
|
||||
const mockDeleteFlow = jest.fn();
|
||||
const mockGetLogStores = jest.fn();
|
||||
const mockFindToken = jest.fn();
|
||||
|
|
@ -53,6 +54,7 @@ jest.mock('~/config', () => ({
|
|||
getServerConfig: (...args) => mockGetServerConfig(...args),
|
||||
getOAuthServers: (...args) => mockGetOAuthServers(...args),
|
||||
getAllowedDomains: (...args) => mockGetAllowedDomains(...args),
|
||||
getAllowedAddresses: (...args) => mockGetAllowedAddresses(...args),
|
||||
})),
|
||||
}));
|
||||
|
||||
|
|
@ -142,6 +144,7 @@ function setupOAuthServerFound() {
|
|||
mockGetServerConfig.mockResolvedValue(serverConfig);
|
||||
mockGetOAuthServers.mockResolvedValue(new Set([serverName]));
|
||||
mockGetAllowedDomains.mockReturnValue(['https://acme.example.com']);
|
||||
mockGetAllowedAddresses.mockReturnValue(null);
|
||||
mockGetClientInfoAndMetadata.mockResolvedValue({ clientInfo, clientMetadata });
|
||||
}
|
||||
|
||||
|
|
|
|||
|
|
@ -22,6 +22,8 @@ const mockRegistryInstance = {
|
|||
addServer: jest.fn(),
|
||||
updateServer: jest.fn(),
|
||||
removeServer: jest.fn(),
|
||||
getAllowedDomains: jest.fn().mockReturnValue(null),
|
||||
getAllowedAddresses: jest.fn().mockReturnValue(null),
|
||||
};
|
||||
|
||||
jest.mock('@librechat/api', () => {
|
||||
|
|
@ -210,6 +212,9 @@ describe('MCP Routes', () => {
|
|||
'test-user-id',
|
||||
{},
|
||||
{ clientId: 'test-client-id' },
|
||||
null,
|
||||
undefined,
|
||||
null,
|
||||
);
|
||||
});
|
||||
|
||||
|
|
|
|||
|
|
@ -118,6 +118,7 @@ router.post(
|
|||
const isDomainAllowed = await isActionDomainAllowed(
|
||||
metadata.domain,
|
||||
appConfig?.actions?.allowedDomains,
|
||||
appConfig?.actions?.allowedAddresses,
|
||||
);
|
||||
if (!isDomainAllowed) {
|
||||
return res.status(400).json({ message: 'Domain not allowed' });
|
||||
|
|
|
|||
|
|
@ -37,6 +37,7 @@ router.post('/:assistant_id', async (req, res) => {
|
|||
const isDomainAllowed = await isActionDomainAllowed(
|
||||
metadata.domain,
|
||||
appConfig?.actions?.allowedDomains,
|
||||
appConfig?.actions?.allowedAddresses,
|
||||
);
|
||||
if (!isDomainAllowed) {
|
||||
return res.status(400).json({ message: 'Domain not allowed' });
|
||||
|
|
|
|||
|
|
@ -107,6 +107,9 @@ router.get('/:serverName/oauth/initiate', requireJwtAuth, setOAuthSession, async
|
|||
|
||||
const configServers = await resolveConfigServers(req);
|
||||
const oauthHeaders = await getOAuthHeaders(serverName, userId, configServers);
|
||||
const registry = getMCPServersRegistry();
|
||||
const allowedDomains = registry.getAllowedDomains();
|
||||
const allowedAddresses = registry.getAllowedAddresses();
|
||||
const {
|
||||
authorizationUrl,
|
||||
flowId: oauthFlowId,
|
||||
|
|
@ -117,6 +120,9 @@ router.get('/:serverName/oauth/initiate', requireJwtAuth, setOAuthSession, async
|
|||
userId,
|
||||
oauthHeaders,
|
||||
oauthConfig,
|
||||
allowedDomains,
|
||||
undefined,
|
||||
allowedAddresses,
|
||||
);
|
||||
|
||||
logger.debug('[MCP OAuth] OAuth flow initiated', { oauthFlowId, authorizationUrl });
|
||||
|
|
|
|||
|
|
@ -175,6 +175,7 @@ async function loadActionSets(searchParams) {
|
|||
* @param {{ oauth_client_id?: string; oauth_client_secret?: string; }} params.encrypted - The encrypted values for the action.
|
||||
* @param {string | null} [params.streamId] - The stream ID for resumable streams.
|
||||
* @param {boolean} [params.useSSRFProtection] - When true, uses SSRF-safe HTTP agents that validate resolved IPs at connect time.
|
||||
* @param {string[] | null} [params.allowedAddresses] - Optional admin exemption list of hostnames/IPs that bypass the SSRF private-IP block.
|
||||
* @returns { Promise<typeof tool | { _call: (toolInput: Object | string) => unknown}> } An object with `_call` method to execute the tool input.
|
||||
*/
|
||||
async function createActionTool({
|
||||
|
|
@ -188,8 +189,9 @@ async function createActionTool({
|
|||
encrypted,
|
||||
streamId = null,
|
||||
useSSRFProtection = false,
|
||||
allowedAddresses,
|
||||
}) {
|
||||
const ssrfAgents = useSSRFProtection ? createSSRFSafeAgents() : undefined;
|
||||
const ssrfAgents = useSSRFProtection ? createSSRFSafeAgents(allowedAddresses) : undefined;
|
||||
/** @type {(toolInput: Object | string, config: GraphRunnableConfig) => Promise<unknown>} */
|
||||
const _call = async (toolInput, config) => {
|
||||
try {
|
||||
|
|
|
|||
|
|
@ -417,7 +417,12 @@ async function createMCPTools({
|
|||
if (serverConfig?.url) {
|
||||
const appConfig = await getAppConfig({ role: user?.role, tenantId: user?.tenantId });
|
||||
const allowedDomains = appConfig?.mcpSettings?.allowedDomains;
|
||||
const isDomainAllowed = await isMCPDomainAllowed(serverConfig, allowedDomains);
|
||||
const allowedAddresses = appConfig?.mcpSettings?.allowedAddresses;
|
||||
const isDomainAllowed = await isMCPDomainAllowed(
|
||||
serverConfig,
|
||||
allowedDomains,
|
||||
allowedAddresses,
|
||||
);
|
||||
if (!isDomainAllowed) {
|
||||
logger.warn(`[MCP][${serverName}] Domain not allowed, skipping all tools`);
|
||||
return [];
|
||||
|
|
@ -500,7 +505,12 @@ async function createMCPTool({
|
|||
if (serverConfig?.url) {
|
||||
const appConfig = await getAppConfig({ role: user?.role, tenantId: user?.tenantId });
|
||||
const allowedDomains = appConfig?.mcpSettings?.allowedDomains;
|
||||
const isDomainAllowed = await isMCPDomainAllowed(serverConfig, allowedDomains);
|
||||
const allowedAddresses = appConfig?.mcpSettings?.allowedAddresses;
|
||||
const isDomainAllowed = await isMCPDomainAllowed(
|
||||
serverConfig,
|
||||
allowedDomains,
|
||||
allowedAddresses,
|
||||
);
|
||||
if (!isDomainAllowed) {
|
||||
logger.warn(`[MCP][${serverName}] Domain no longer allowed, skipping tool: ${toolName}`);
|
||||
return undefined;
|
||||
|
|
|
|||
|
|
@ -929,6 +929,7 @@ describe('User parameter passing tests', () => {
|
|||
expect(mockIsMCPDomainAllowed).toHaveBeenCalledWith(
|
||||
{ url: 'https://disallowed-domain.com/sse' },
|
||||
['allowed-domain.com'],
|
||||
undefined,
|
||||
);
|
||||
});
|
||||
|
||||
|
|
|
|||
|
|
@ -360,6 +360,7 @@ async function processRequiredActions(client, requiredActions) {
|
|||
const isDomainAllowed = await isActionDomainAllowed(
|
||||
action.metadata.domain,
|
||||
appConfig?.actions?.allowedDomains,
|
||||
appConfig?.actions?.allowedAddresses,
|
||||
);
|
||||
if (!isDomainAllowed) {
|
||||
continue;
|
||||
|
|
@ -428,6 +429,7 @@ async function processRequiredActions(client, requiredActions) {
|
|||
|
||||
// We've already decrypted the metadata, so we can pass it directly
|
||||
const _allowedDomains = appConfig?.actions?.allowedDomains;
|
||||
const _allowedAddresses = appConfig?.actions?.allowedAddresses;
|
||||
tool = await createActionTool({
|
||||
userId: client.req.user.id,
|
||||
res: client.res,
|
||||
|
|
@ -436,6 +438,7 @@ async function processRequiredActions(client, requiredActions) {
|
|||
// Note: intentionally not passing zodSchema, name, and description for assistants API
|
||||
encrypted, // Pass the encrypted values for OAuth flow
|
||||
useSSRFProtection: !Array.isArray(_allowedDomains) || _allowedDomains.length === 0,
|
||||
allowedAddresses: _allowedAddresses,
|
||||
});
|
||||
if (!tool) {
|
||||
logger.warn(
|
||||
|
|
@ -659,6 +662,7 @@ async function loadToolDefinitionsWrapper({ req, res, agent, streamId = null, to
|
|||
|
||||
const definitions = [];
|
||||
const allowedDomains = appConfig?.actions?.allowedDomains;
|
||||
const allowedAddresses = appConfig?.actions?.allowedAddresses;
|
||||
const normalizedToolNames = new Set(
|
||||
actionToolNames.map((n) => n.replace(domainSeparatorRegex, '_')),
|
||||
);
|
||||
|
|
@ -670,7 +674,11 @@ async function loadToolDefinitionsWrapper({ req, res, agent, streamId = null, to
|
|||
const legacyDomain = legacyDomainEncode(action.metadata.domain);
|
||||
const legacyNormalized = legacyDomain.replace(domainSeparatorRegex, '_');
|
||||
|
||||
const isDomainAllowed = await isActionDomainAllowed(action.metadata.domain, allowedDomains);
|
||||
const isDomainAllowed = await isActionDomainAllowed(
|
||||
action.metadata.domain,
|
||||
allowedDomains,
|
||||
allowedAddresses,
|
||||
);
|
||||
if (!isDomainAllowed) {
|
||||
logger.warn(
|
||||
`[Actions] Domain "${action.metadata.domain}" not in allowedDomains. ` +
|
||||
|
|
@ -1094,6 +1102,7 @@ async function loadAgentTools({
|
|||
const isDomainAllowed = await isActionDomainAllowed(
|
||||
action.metadata.domain,
|
||||
appConfig?.actions?.allowedDomains,
|
||||
appConfig?.actions?.allowedAddresses,
|
||||
);
|
||||
if (!isDomainAllowed) {
|
||||
continue;
|
||||
|
|
@ -1165,6 +1174,7 @@ async function loadAgentTools({
|
|||
|
||||
const { action, encrypted, zodSchema, requestBuilder, functionSignature } = entry;
|
||||
const _allowedDomains = appConfig?.actions?.allowedDomains;
|
||||
const _allowedAddresses = appConfig?.actions?.allowedAddresses;
|
||||
const tool = await createActionTool({
|
||||
userId: req.user.id,
|
||||
res,
|
||||
|
|
@ -1176,6 +1186,7 @@ async function loadAgentTools({
|
|||
description: functionSignature.description,
|
||||
streamId,
|
||||
useSSRFProtection: !Array.isArray(_allowedDomains) || _allowedDomains.length === 0,
|
||||
allowedAddresses: _allowedAddresses,
|
||||
});
|
||||
|
||||
if (!tool) {
|
||||
|
|
@ -1406,6 +1417,7 @@ async function loadActionToolsForExecution({
|
|||
// See registerActionTools for the key-shape rationale.
|
||||
const toolToAction = new Map();
|
||||
const allowedDomains = appConfig?.actions?.allowedDomains;
|
||||
const allowedAddresses = appConfig?.actions?.allowedAddresses;
|
||||
|
||||
for (const action of actionSets) {
|
||||
const domain = await domainParser(action.metadata.domain, true);
|
||||
|
|
@ -1413,7 +1425,11 @@ async function loadActionToolsForExecution({
|
|||
const legacyDomain = legacyDomainEncode(action.metadata.domain);
|
||||
const legacyNormalized = legacyDomain.replace(domainSeparatorRegex, '_');
|
||||
|
||||
const isDomainAllowed = await isActionDomainAllowed(action.metadata.domain, allowedDomains);
|
||||
const isDomainAllowed = await isActionDomainAllowed(
|
||||
action.metadata.domain,
|
||||
allowedDomains,
|
||||
allowedAddresses,
|
||||
);
|
||||
if (!isDomainAllowed) {
|
||||
logger.warn(
|
||||
`[Actions] Domain "${action.metadata.domain}" not in allowedDomains. ` +
|
||||
|
|
@ -1487,6 +1503,7 @@ async function loadActionToolsForExecution({
|
|||
name: toolName,
|
||||
description: functionSignature.description,
|
||||
useSSRFProtection: !Array.isArray(allowedDomains) || allowedDomains.length === 0,
|
||||
allowedAddresses,
|
||||
});
|
||||
|
||||
if (!tool) {
|
||||
|
|
|
|||
|
|
@ -11,7 +11,11 @@ async function initializeMCPs() {
|
|||
const mcpServers = appConfig.mcpConfig;
|
||||
|
||||
try {
|
||||
createMCPServersRegistry(mongoose, appConfig?.mcpSettings?.allowedDomains);
|
||||
createMCPServersRegistry(
|
||||
mongoose,
|
||||
appConfig?.mcpSettings?.allowedDomains,
|
||||
appConfig?.mcpSettings?.allowedAddresses,
|
||||
);
|
||||
} catch (error) {
|
||||
logger.error('[MCP] Failed to initialize MCPServersRegistry:', error);
|
||||
throw error;
|
||||
|
|
|
|||
|
|
@ -81,6 +81,7 @@ describe('initializeMCPs', () => {
|
|||
expect(mockCreateMCPServersRegistry).toHaveBeenCalledWith(
|
||||
expect.anything(), // mongoose
|
||||
['localhost'],
|
||||
undefined,
|
||||
);
|
||||
});
|
||||
|
||||
|
|
@ -93,7 +94,11 @@ describe('initializeMCPs', () => {
|
|||
|
||||
await initializeMCPs();
|
||||
|
||||
expect(mockCreateMCPServersRegistry).toHaveBeenCalledWith(expect.anything(), allowedDomains);
|
||||
expect(mockCreateMCPServersRegistry).toHaveBeenCalledWith(
|
||||
expect.anything(),
|
||||
allowedDomains,
|
||||
undefined,
|
||||
);
|
||||
});
|
||||
|
||||
it('should handle undefined mcpSettings gracefully', async () => {
|
||||
|
|
@ -104,7 +109,11 @@ describe('initializeMCPs', () => {
|
|||
|
||||
await initializeMCPs();
|
||||
|
||||
expect(mockCreateMCPServersRegistry).toHaveBeenCalledWith(expect.anything(), undefined);
|
||||
expect(mockCreateMCPServersRegistry).toHaveBeenCalledWith(
|
||||
expect.anything(),
|
||||
undefined,
|
||||
undefined,
|
||||
);
|
||||
});
|
||||
|
||||
it('should throw and log error if MCPServersRegistry initialization fails', async () => {
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue