Vladimir-Kryshchenko/dsh-route-fence-linter

README 摘要

dsh-route-fence-linter Every plugin route registered on webServer is dispatched by longest-prefix match , ahead of the host's /api gateway — so it never passes the gateway's unified trust check. Each plugin author must ship their own browser-trust fence, and most do not. This linter finds the ones that did not. Usage Exit codes: 0 clean · 1 at least one FAIL · 2 usage/IO error. Verdicts Verdict Meaning PASS The handler gates on a fence that pins the Host before Origin handling. WARN Inside the fence, Origin / sec-fetch-site is read before the Host is pinned. Confirm the ordering by hand. FAIL One of: no Host check anywhere; a fence that compares Origin to Host but never pins the Host to loopback (bypassable by DNS rebinding — the attacker controls both headers and they match); or a fence that exists but this handler never calls. Bundles whose sources cannot be read are reported as SKIP and counted in the summary — a skipped bundle is not a clean bundle. registerFallback is checked too, and reads worse than any route when unfenced: the fallback seat answers every request no named route matched , so one unfenced fallback is a wider surface than a whole prefix tree. Scan scope The sca…

分类