Coder/deepseek-harness
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(web): clarify wildcard host safety warning

Browse Source
This commit is contained in:
Tianyi Cui
2026-08-13 15:10:12 +08:00
parent 6cbf927e0a
commit 0633add19d
2 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
packages/bundle/web-app/src/startup.ts
View File

@@ -67,7 +67,7 @@ export function apply(ctx: Context): void {
program.action(() => { program.action(() => {
const options = program.opts<WebOptions>() const options = program.opts<WebOptions>()
if (options.host === '0.0.0.0') { if (options.host === '0.0.0.0') {
program.error('error: --host 0.0.0.0 is intentionally not supported yet; use 127.0.0.1 instead') program.error('error: --host 0.0.0.0 is intentionally not supported yet for safety: it would expose remote code execution to the network; use 127.0.0.1 instead')
} }
if (options.port !== undefined && !/^\d+$/.test(options.port)) { if (options.port !== undefined && !/^\d+$/.test(options.port)) {
program.error(`error: --port must be a number, got ${JSON.stringify(options.port)}`) program.error(`error: --port must be a number, got ${JSON.stringify(options.port)}`)

2
packages/bundle/web-app/tests/startup.spec.ts
View File

@@ -131,7 +131,7 @@ describe('web command-line provider', () => {
it('rejects the intentionally unsupported all-interfaces host before the consumer activates', async () => { it('rejects the intentionally unsupported all-interfaces host before the consumer activates', async () => {
const { values, observed } = await bootProvider(['--host', '0.0.0.0']) const { values, observed } = await bootProvider(['--host', '0.0.0.0'])
expect(observed.out).toContain('--host 0.0.0.0 is intentionally not supported yet; use 127.0.0.1 instead') expect(observed.out).toContain('--host 0.0.0.0 is intentionally not supported yet for safety: it would expose remote code execution to the network; use 127.0.0.1 instead')
expect(values).toBeUndefined() expect(values).toBeUndefined()
expect(observed.readerConfig).toBeUndefined() expect(observed.readerConfig).toBeUndefined()
expect(observed.exits).toEqual([1]) expect(observed.exits).toEqual([1])