fix: prevent Host header bypass vulnerability by ammario · Pull Request #58 · coder/httpjail

ammario · 2025-09-21T16:13:18Z

Summary

This PR fixes a security vulnerability where an attacker could bypass proxy restrictions by sending requests with mismatched Host headers, as described in #57.

The Vulnerability

The issue allowed sending a request to one domain (e.g., api.anthropic.com) while setting the Host header to another domain (e.g., evil.com). This could cause CDNs like CloudFlare to route the request to the attacker's server instead of the intended destination, potentially enabling:

Data exfiltration from CloudFlare-protected sites
Bypassing proxy restrictions for protected domains

The Fix

Modified prepare_upstream_request() in src/proxy.rs to ensure the Host header always matches the URI authority. The fix:

Extracts the authority (domain:port) from the target URI
Overwrites any existing Host header with the correct value
Applies to both HTTP and HTTPS requests

Testing

Added comprehensive test coverage in tests/weak_integration.rs:

✅ HTTP requests with mismatched Host headers are corrected
✅ HTTPS requests with mismatched Host headers are corrected
✅ Legitimate matching Host headers work normally
✅ Host headers with port numbers are handled correctly
✅ Requests without explicit Host headers get the correct default

Verification

# Run the security test
cargo test --test weak_integration test_host_header_security
# Run all tests
cargo test

All tests pass and the code meets quality standards (clippy, formatting).

Fixes#57

🤖 Generated with Claude Code

This commit fixes a security vulnerability where an attacker could bypass proxy restrictions by sending requests with mismatched Host headers. The vulnerability allowed sending a request to one domain (e.g., api.anthropic.com) while setting the Host header to another domain (e.g., evil.com), which could cause CDNs like CloudFlare to route the request to the attacker's server. Changes: - Modified prepare_upstream_request() to ensure Host header always matches URI authority - Added comprehensive test coverage in weak_integration.rs - Validates both HTTP and HTTPS requests This prevents data exfiltration and unauthorized access to protected domains. Fixes#57 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude <noreply@anthropic.com>

Simplified the test to clearly demonstrate the vulnerability and fix by: - Running the same curl command directly (shows evil.com passes through) - Running it through httpjail (shows it's corrected to httpbin.org) This makes it clearer that httpjail prevents the Host header bypass attack that would otherwise be possible. 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude <noreply@anthropic.com>

Added a TODO note documenting future improvement to use the type system to ensure all request information passed to upstream has been validated by the RuleEngine. This would provide compile-time guarantees that security checks cannot be bypassed. 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude <noreply@anthropic.com>

chatgpt-codex-connector

Codex Review: Here are some suggestions.

Reply with @codex fix comments to fix any unresolved comments.

About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you open a pull request for review, mark a draft as ready, or comment "@codex review". If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex fix this CI failure" or "@codex address that feedback".

ammario · 2025-09-21T17:10:48Z

Created issue #59 to track the TODO for using the type system to prevent request validation bypasses. This would make security vulnerabilities like the Host header bypass impossible at compile time.

ammario · 2025-09-21T16:13:18Z

Summary

This PR fixes a security vulnerability where an attacker could bypass proxy restrictions by sending requests with mismatched Host headers, as described in #57.

The Vulnerability

The issue allowed sending a request to one domain (e.g., api.anthropic.com) while setting the Host header to another domain (e.g., evil.com). This could cause CDNs like CloudFlare to route the request to the attacker's server instead of the intended destination, potentially enabling:

Data exfiltration from CloudFlare-protected sites
Bypassing proxy restrictions for protected domains

The Fix

Modified prepare_upstream_request() in src/proxy.rs to ensure the Host header always matches the URI authority. The fix:

Extracts the authority (domain:port) from the target URI
Overwrites any existing Host header with the correct value
Applies to both HTTP and HTTPS requests

Testing

Added comprehensive test coverage in tests/weak_integration.rs:

✅ HTTP requests with mismatched Host headers are corrected
✅ HTTPS requests with mismatched Host headers are corrected
✅ Legitimate matching Host headers work normally
✅ Host headers with port numbers are handled correctly
✅ Requests without explicit Host headers get the correct default

Verification

# Run the security test
cargo test --test weak_integration test_host_header_security
# Run all tests
cargo test

All tests pass and the code meets quality standards (clippy, formatting).

Fixes#57

🤖 Generated with Claude Code

This commit fixes a security vulnerability where an attacker could bypass proxy restrictions by sending requests with mismatched Host headers. The vulnerability allowed sending a request to one domain (e.g., api.anthropic.com) while setting the Host header to another domain (e.g., evil.com), which could cause CDNs like CloudFlare to route the request to the attacker's server. Changes: - Modified prepare_upstream_request() to ensure Host header always matches URI authority - Added comprehensive test coverage in weak_integration.rs - Validates both HTTP and HTTPS requests This prevents data exfiltration and unauthorized access to protected domains. Fixes#57 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude <noreply@anthropic.com>

Simplified the test to clearly demonstrate the vulnerability and fix by: - Running the same curl command directly (shows evil.com passes through) - Running it through httpjail (shows it's corrected to httpbin.org) This makes it clearer that httpjail prevents the Host header bypass attack that would otherwise be possible. 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude <noreply@anthropic.com>

Added a TODO note documenting future improvement to use the type system to ensure all request information passed to upstream has been validated by the RuleEngine. This would provide compile-time guarantees that security checks cannot be bypassed. 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude <noreply@anthropic.com>

chatgpt-codex-connector

Codex Review: Here are some suggestions.

Reply with @codex fix comments to fix any unresolved comments.

About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you open a pull request for review, mark a draft as ready, or comment "@codex review". If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex fix this CI failure" or "@codex address that feedback".

ammario · 2025-09-21T17:10:48Z

Created issue #59 to track the TODO for using the type system to prevent request validation bypasses. This would make security vulnerabilities like the Host header bypass impossible at compile time.

ammario · 2025-09-21T16:13:18Z

Summary

This PR fixes a security vulnerability where an attacker could bypass proxy restrictions by sending requests with mismatched Host headers, as described in #57.

The Vulnerability

The issue allowed sending a request to one domain (e.g., api.anthropic.com) while setting the Host header to another domain (e.g., evil.com). This could cause CDNs like CloudFlare to route the request to the attacker's server instead of the intended destination, potentially enabling:

Data exfiltration from CloudFlare-protected sites
Bypassing proxy restrictions for protected domains

The Fix

Modified prepare_upstream_request() in src/proxy.rs to ensure the Host header always matches the URI authority. The fix:

Extracts the authority (domain:port) from the target URI
Overwrites any existing Host header with the correct value
Applies to both HTTP and HTTPS requests

Testing

Added comprehensive test coverage in tests/weak_integration.rs:

✅ HTTP requests with mismatched Host headers are corrected
✅ HTTPS requests with mismatched Host headers are corrected
✅ Legitimate matching Host headers work normally
✅ Host headers with port numbers are handled correctly
✅ Requests without explicit Host headers get the correct default

Verification

# Run the security test
cargo test --test weak_integration test_host_header_security
# Run all tests
cargo test

All tests pass and the code meets quality standards (clippy, formatting).

Fixes#57

🤖 Generated with Claude Code

This commit fixes a security vulnerability where an attacker could bypass proxy restrictions by sending requests with mismatched Host headers. The vulnerability allowed sending a request to one domain (e.g., api.anthropic.com) while setting the Host header to another domain (e.g., evil.com), which could cause CDNs like CloudFlare to route the request to the attacker's server. Changes: - Modified prepare_upstream_request() to ensure Host header always matches URI authority - Added comprehensive test coverage in weak_integration.rs - Validates both HTTP and HTTPS requests This prevents data exfiltration and unauthorized access to protected domains. Fixes#57 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude <noreply@anthropic.com>

Simplified the test to clearly demonstrate the vulnerability and fix by: - Running the same curl command directly (shows evil.com passes through) - Running it through httpjail (shows it's corrected to httpbin.org) This makes it clearer that httpjail prevents the Host header bypass attack that would otherwise be possible. 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude <noreply@anthropic.com>

Added a TODO note documenting future improvement to use the type system to ensure all request information passed to upstream has been validated by the RuleEngine. This would provide compile-time guarantees that security checks cannot be bypassed. 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude <noreply@anthropic.com>

chatgpt-codex-connector

Codex Review: Here are some suggestions.

Reply with @codex fix comments to fix any unresolved comments.

About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you open a pull request for review, mark a draft as ready, or comment "@codex review". If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex fix this CI failure" or "@codex address that feedback".

ammario · 2025-09-21T17:10:48Z

Created issue #59 to track the TODO for using the type system to prevent request validation bypasses. This would make security vulnerabilities like the Host header bypass impossible at compile time.

ammario · 2025-09-21T16:13:18Z

Summary

This PR fixes a security vulnerability where an attacker could bypass proxy restrictions by sending requests with mismatched Host headers, as described in #57.

The Vulnerability

The issue allowed sending a request to one domain (e.g., api.anthropic.com) while setting the Host header to another domain (e.g., evil.com). This could cause CDNs like CloudFlare to route the request to the attacker's server instead of the intended destination, potentially enabling:

Data exfiltration from CloudFlare-protected sites
Bypassing proxy restrictions for protected domains

The Fix

Modified prepare_upstream_request() in src/proxy.rs to ensure the Host header always matches the URI authority. The fix:

Extracts the authority (domain:port) from the target URI
Overwrites any existing Host header with the correct value
Applies to both HTTP and HTTPS requests

Testing

Added comprehensive test coverage in tests/weak_integration.rs:

✅ HTTP requests with mismatched Host headers are corrected
✅ HTTPS requests with mismatched Host headers are corrected
✅ Legitimate matching Host headers work normally
✅ Host headers with port numbers are handled correctly
✅ Requests without explicit Host headers get the correct default

Verification

# Run the security test
cargo test --test weak_integration test_host_header_security
# Run all tests
cargo test

All tests pass and the code meets quality standards (clippy, formatting).

Fixes#57

🤖 Generated with Claude Code

This commit fixes a security vulnerability where an attacker could bypass proxy restrictions by sending requests with mismatched Host headers. The vulnerability allowed sending a request to one domain (e.g., api.anthropic.com) while setting the Host header to another domain (e.g., evil.com), which could cause CDNs like CloudFlare to route the request to the attacker's server. Changes: - Modified prepare_upstream_request() to ensure Host header always matches URI authority - Added comprehensive test coverage in weak_integration.rs - Validates both HTTP and HTTPS requests This prevents data exfiltration and unauthorized access to protected domains. Fixes#57 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude <noreply@anthropic.com>

Simplified the test to clearly demonstrate the vulnerability and fix by: - Running the same curl command directly (shows evil.com passes through) - Running it through httpjail (shows it's corrected to httpbin.org) This makes it clearer that httpjail prevents the Host header bypass attack that would otherwise be possible. 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude <noreply@anthropic.com>

Added a TODO note documenting future improvement to use the type system to ensure all request information passed to upstream has been validated by the RuleEngine. This would provide compile-time guarantees that security checks cannot be bypassed. 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude <noreply@anthropic.com>

chatgpt-codex-connector

Codex Review: Here are some suggestions.

Reply with @codex fix comments to fix any unresolved comments.

About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you open a pull request for review, mark a draft as ready, or comment "@codex review". If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex fix this CI failure" or "@codex address that feedback".

ammario · 2025-09-21T17:10:48Z

Created issue #59 to track the TODO for using the type system to prevent request validation bypasses. This would make security vulnerabilities like the Host header bypass impossible at compile time.

ammario · 2025-09-21T16:13:18Z

Summary

This PR fixes a security vulnerability where an attacker could bypass proxy restrictions by sending requests with mismatched Host headers, as described in #57.

The Vulnerability

The issue allowed sending a request to one domain (e.g., api.anthropic.com) while setting the Host header to another domain (e.g., evil.com). This could cause CDNs like CloudFlare to route the request to the attacker's server instead of the intended destination, potentially enabling:

Data exfiltration from CloudFlare-protected sites
Bypassing proxy restrictions for protected domains

The Fix

Modified prepare_upstream_request() in src/proxy.rs to ensure the Host header always matches the URI authority. The fix:

Extracts the authority (domain:port) from the target URI
Overwrites any existing Host header with the correct value
Applies to both HTTP and HTTPS requests

Testing

Added comprehensive test coverage in tests/weak_integration.rs:

✅ HTTP requests with mismatched Host headers are corrected
✅ HTTPS requests with mismatched Host headers are corrected
✅ Legitimate matching Host headers work normally
✅ Host headers with port numbers are handled correctly
✅ Requests without explicit Host headers get the correct default

Verification

# Run the security test
cargo test --test weak_integration test_host_header_security
# Run all tests
cargo test

All tests pass and the code meets quality standards (clippy, formatting).

Fixes#57

🤖 Generated with Claude Code

This commit fixes a security vulnerability where an attacker could bypass proxy restrictions by sending requests with mismatched Host headers. The vulnerability allowed sending a request to one domain (e.g., api.anthropic.com) while setting the Host header to another domain (e.g., evil.com), which could cause CDNs like CloudFlare to route the request to the attacker's server. Changes: - Modified prepare_upstream_request() to ensure Host header always matches URI authority - Added comprehensive test coverage in weak_integration.rs - Validates both HTTP and HTTPS requests This prevents data exfiltration and unauthorized access to protected domains. Fixes#57 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude <noreply@anthropic.com>

Simplified the test to clearly demonstrate the vulnerability and fix by: - Running the same curl command directly (shows evil.com passes through) - Running it through httpjail (shows it's corrected to httpbin.org) This makes it clearer that httpjail prevents the Host header bypass attack that would otherwise be possible. 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude <noreply@anthropic.com>

Added a TODO note documenting future improvement to use the type system to ensure all request information passed to upstream has been validated by the RuleEngine. This would provide compile-time guarantees that security checks cannot be bypassed. 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude <noreply@anthropic.com>

chatgpt-codex-connector

Codex Review: Here are some suggestions.

Reply with @codex fix comments to fix any unresolved comments.

About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you open a pull request for review, mark a draft as ready, or comment "@codex review". If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex fix this CI failure" or "@codex address that feedback".

ammario · 2025-09-21T17:10:48Z

Created issue #59 to track the TODO for using the type system to prevent request validation bypasses. This would make security vulnerabilities like the Host header bypass impossible at compile time.

ammario · 2025-09-21T16:13:18Z

Summary

This PR fixes a security vulnerability where an attacker could bypass proxy restrictions by sending requests with mismatched Host headers, as described in #57.

The Vulnerability

The issue allowed sending a request to one domain (e.g., api.anthropic.com) while setting the Host header to another domain (e.g., evil.com). This could cause CDNs like CloudFlare to route the request to the attacker's server instead of the intended destination, potentially enabling:

Data exfiltration from CloudFlare-protected sites
Bypassing proxy restrictions for protected domains

The Fix

Modified prepare_upstream_request() in src/proxy.rs to ensure the Host header always matches the URI authority. The fix:

Extracts the authority (domain:port) from the target URI
Overwrites any existing Host header with the correct value
Applies to both HTTP and HTTPS requests

Testing

Added comprehensive test coverage in tests/weak_integration.rs:

✅ HTTP requests with mismatched Host headers are corrected
✅ HTTPS requests with mismatched Host headers are corrected
✅ Legitimate matching Host headers work normally
✅ Host headers with port numbers are handled correctly
✅ Requests without explicit Host headers get the correct default

Verification

# Run the security test
cargo test --test weak_integration test_host_header_security
# Run all tests
cargo test

All tests pass and the code meets quality standards (clippy, formatting).

Fixes#57

🤖 Generated with Claude Code

This commit fixes a security vulnerability where an attacker could bypass proxy restrictions by sending requests with mismatched Host headers. The vulnerability allowed sending a request to one domain (e.g., api.anthropic.com) while setting the Host header to another domain (e.g., evil.com), which could cause CDNs like CloudFlare to route the request to the attacker's server. Changes: - Modified prepare_upstream_request() to ensure Host header always matches URI authority - Added comprehensive test coverage in weak_integration.rs - Validates both HTTP and HTTPS requests This prevents data exfiltration and unauthorized access to protected domains. Fixes#57 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude <noreply@anthropic.com>

Simplified the test to clearly demonstrate the vulnerability and fix by: - Running the same curl command directly (shows evil.com passes through) - Running it through httpjail (shows it's corrected to httpbin.org) This makes it clearer that httpjail prevents the Host header bypass attack that would otherwise be possible. 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude <noreply@anthropic.com>

Added a TODO note documenting future improvement to use the type system to ensure all request information passed to upstream has been validated by the RuleEngine. This would provide compile-time guarantees that security checks cannot be bypassed. 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude <noreply@anthropic.com>

chatgpt-codex-connector

Codex Review: Here are some suggestions.

Reply with @codex fix comments to fix any unresolved comments.

About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you open a pull request for review, mark a draft as ready, or comment "@codex review". If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex fix this CI failure" or "@codex address that feedback".

ammario · 2025-09-21T17:10:48Z

Created issue #59 to track the TODO for using the type system to prevent request validation bypasses. This would make security vulnerabilities like the Host header bypass impossible at compile time.

ammario · 2025-09-21T16:13:18Z

Summary

This PR fixes a security vulnerability where an attacker could bypass proxy restrictions by sending requests with mismatched Host headers, as described in #57.

The Vulnerability

The issue allowed sending a request to one domain (e.g., api.anthropic.com) while setting the Host header to another domain (e.g., evil.com). This could cause CDNs like CloudFlare to route the request to the attacker's server instead of the intended destination, potentially enabling:

Data exfiltration from CloudFlare-protected sites
Bypassing proxy restrictions for protected domains

The Fix

Modified prepare_upstream_request() in src/proxy.rs to ensure the Host header always matches the URI authority. The fix:

Extracts the authority (domain:port) from the target URI
Overwrites any existing Host header with the correct value
Applies to both HTTP and HTTPS requests

Testing

Added comprehensive test coverage in tests/weak_integration.rs:

✅ HTTP requests with mismatched Host headers are corrected
✅ HTTPS requests with mismatched Host headers are corrected
✅ Legitimate matching Host headers work normally
✅ Host headers with port numbers are handled correctly
✅ Requests without explicit Host headers get the correct default

Verification

# Run the security test
cargo test --test weak_integration test_host_header_security
# Run all tests
cargo test

All tests pass and the code meets quality standards (clippy, formatting).

Fixes#57

🤖 Generated with Claude Code

This commit fixes a security vulnerability where an attacker could bypass proxy restrictions by sending requests with mismatched Host headers. The vulnerability allowed sending a request to one domain (e.g., api.anthropic.com) while setting the Host header to another domain (e.g., evil.com), which could cause CDNs like CloudFlare to route the request to the attacker's server. Changes: - Modified prepare_upstream_request() to ensure Host header always matches URI authority - Added comprehensive test coverage in weak_integration.rs - Validates both HTTP and HTTPS requests This prevents data exfiltration and unauthorized access to protected domains. Fixes#57 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude <noreply@anthropic.com>

Simplified the test to clearly demonstrate the vulnerability and fix by: - Running the same curl command directly (shows evil.com passes through) - Running it through httpjail (shows it's corrected to httpbin.org) This makes it clearer that httpjail prevents the Host header bypass attack that would otherwise be possible. 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude <noreply@anthropic.com>

Added a TODO note documenting future improvement to use the type system to ensure all request information passed to upstream has been validated by the RuleEngine. This would provide compile-time guarantees that security checks cannot be bypassed. 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude <noreply@anthropic.com>

chatgpt-codex-connector

Codex Review: Here are some suggestions.

Reply with @codex fix comments to fix any unresolved comments.

About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you open a pull request for review, mark a draft as ready, or comment "@codex review". If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex fix this CI failure" or "@codex address that feedback".

ammario · 2025-09-21T17:10:48Z

Created issue #59 to track the TODO for using the type system to prevent request validation bypasses. This would make security vulnerabilities like the Host header bypass impossible at compile time.

ammario · 2025-09-21T16:13:18Z

Summary

This PR fixes a security vulnerability where an attacker could bypass proxy restrictions by sending requests with mismatched Host headers, as described in #57.

The Vulnerability

The issue allowed sending a request to one domain (e.g., api.anthropic.com) while setting the Host header to another domain (e.g., evil.com). This could cause CDNs like CloudFlare to route the request to the attacker's server instead of the intended destination, potentially enabling:

Data exfiltration from CloudFlare-protected sites
Bypassing proxy restrictions for protected domains

The Fix

Modified prepare_upstream_request() in src/proxy.rs to ensure the Host header always matches the URI authority. The fix:

Extracts the authority (domain:port) from the target URI
Overwrites any existing Host header with the correct value
Applies to both HTTP and HTTPS requests

Testing

Added comprehensive test coverage in tests/weak_integration.rs:

✅ HTTP requests with mismatched Host headers are corrected
✅ HTTPS requests with mismatched Host headers are corrected
✅ Legitimate matching Host headers work normally
✅ Host headers with port numbers are handled correctly
✅ Requests without explicit Host headers get the correct default

Verification

# Run the security test
cargo test --test weak_integration test_host_header_security
# Run all tests
cargo test

All tests pass and the code meets quality standards (clippy, formatting).

Fixes#57

🤖 Generated with Claude Code

This commit fixes a security vulnerability where an attacker could bypass proxy restrictions by sending requests with mismatched Host headers. The vulnerability allowed sending a request to one domain (e.g., api.anthropic.com) while setting the Host header to another domain (e.g., evil.com), which could cause CDNs like CloudFlare to route the request to the attacker's server. Changes: - Modified prepare_upstream_request() to ensure Host header always matches URI authority - Added comprehensive test coverage in weak_integration.rs - Validates both HTTP and HTTPS requests This prevents data exfiltration and unauthorized access to protected domains. Fixes#57 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude <noreply@anthropic.com>

Simplified the test to clearly demonstrate the vulnerability and fix by: - Running the same curl command directly (shows evil.com passes through) - Running it through httpjail (shows it's corrected to httpbin.org) This makes it clearer that httpjail prevents the Host header bypass attack that would otherwise be possible. 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude <noreply@anthropic.com>

Added a TODO note documenting future improvement to use the type system to ensure all request information passed to upstream has been validated by the RuleEngine. This would provide compile-time guarantees that security checks cannot be bypassed. 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude <noreply@anthropic.com>

chatgpt-codex-connector

Codex Review: Here are some suggestions.

Reply with @codex fix comments to fix any unresolved comments.

About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you open a pull request for review, mark a draft as ready, or comment "@codex review". If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex fix this CI failure" or "@codex address that feedback".

ammario · 2025-09-21T17:10:48Z

Created issue #59 to track the TODO for using the type system to prevent request validation bypasses. This would make security vulnerabilities like the Host header bypass impossible at compile time.

ammarioand others added 4 commits September 21, 2025 11:12

fix: remove unnecessary into_iter() call to satisfy clippy
785f080

ammario marked this pull request as ready for review September 21, 2025 16:38

chatgpt-codex-connectorBot reviewed Sep 21, 2025
View reviewed changes

Comment threadtests/weak_integration.rs

ammario merged commit 664cd1a into mainSep 21, 2025
6 checks passed

ammario deleted the url-security branch September 21, 2025 17:09

ammario mentioned this pull request Sep 21, 2025
Use type system to prevent request validation bypasses #59
Open

ammarioand others added 4 commits September 21, 2025 11:12

fix: remove unnecessary into_iter() call to satisfy clippy
785f080

ammario marked this pull request as ready for review September 21, 2025 16:38

chatgpt-codex-connectorBot reviewed Sep 21, 2025
View reviewed changes

Comment threadtests/weak_integration.rs

ammario merged commit 664cd1a into mainSep 21, 2025
6 checks passed

ammario deleted the url-security branch September 21, 2025 17:09

ammario mentioned this pull request Sep 21, 2025
Use type system to prevent request validation bypasses #59
Open

ammarioand others added 4 commits September 21, 2025 11:12

fix: remove unnecessary into_iter() call to satisfy clippy
785f080

ammario marked this pull request as ready for review September 21, 2025 16:38

chatgpt-codex-connectorBot reviewed Sep 21, 2025
View reviewed changes

Comment threadtests/weak_integration.rs

ammario merged commit 664cd1a into mainSep 21, 2025
6 checks passed

ammario deleted the url-security branch September 21, 2025 17:09

ammario mentioned this pull request Sep 21, 2025
Use type system to prevent request validation bypasses #59
Open

ammarioand others added 4 commits September 21, 2025 11:12

fix: remove unnecessary into_iter() call to satisfy clippy
785f080

ammario marked this pull request as ready for review September 21, 2025 16:38

chatgpt-codex-connectorBot reviewed Sep 21, 2025
View reviewed changes

Comment threadtests/weak_integration.rs

ammario merged commit 664cd1a into mainSep 21, 2025
6 checks passed

ammario deleted the url-security branch September 21, 2025 17:09

ammario mentioned this pull request Sep 21, 2025
Use type system to prevent request validation bypasses #59
Open

ammarioand others added 4 commits September 21, 2025 11:12

fix: remove unnecessary into_iter() call to satisfy clippy
785f080

ammario marked this pull request as ready for review September 21, 2025 16:38

chatgpt-codex-connectorBot reviewed Sep 21, 2025
View reviewed changes

Comment threadtests/weak_integration.rs

ammario merged commit 664cd1a into mainSep 21, 2025
6 checks passed

ammario deleted the url-security branch September 21, 2025 17:09

ammario mentioned this pull request Sep 21, 2025
Use type system to prevent request validation bypasses #59
Open

ammarioand others added 4 commits September 21, 2025 11:12

fix: remove unnecessary into_iter() call to satisfy clippy
785f080

ammario marked this pull request as ready for review September 21, 2025 16:38

chatgpt-codex-connectorBot reviewed Sep 21, 2025
View reviewed changes

Comment threadtests/weak_integration.rs

ammario merged commit 664cd1a into mainSep 21, 2025
6 checks passed

ammario deleted the url-security branch September 21, 2025 17:09

ammario mentioned this pull request Sep 21, 2025
Use type system to prevent request validation bypasses #59
Open

ammarioand others added 4 commits September 21, 2025 11:12

fix: remove unnecessary into_iter() call to satisfy clippy
785f080

ammario marked this pull request as ready for review September 21, 2025 16:38

chatgpt-codex-connectorBot reviewed Sep 21, 2025
View reviewed changes

Comment threadtests/weak_integration.rs

ammario merged commit 664cd1a into mainSep 21, 2025
6 checks passed

ammario deleted the url-security branch September 21, 2025 17:09

ammario mentioned this pull request Sep 21, 2025
Use type system to prevent request validation bypasses #59
Open

ammarioand others added 4 commits September 21, 2025 11:12

fix: remove unnecessary into_iter() call to satisfy clippy
785f080

ammario marked this pull request as ready for review September 21, 2025 16:38

chatgpt-codex-connectorBot reviewed Sep 21, 2025
View reviewed changes

Comment threadtests/weak_integration.rs

ammario merged commit 664cd1a into mainSep 21, 2025
6 checks passed

ammario deleted the url-security branch September 21, 2025 17:09

ammario mentioned this pull request Sep 21, 2025
Use type system to prevent request validation bypasses #59
Open

Uh oh!

Conversation

ammario commented Sep 21, 2025

Summary

The Vulnerability

The Fix

Testing

Verification

Uh oh!

chatgpt-codex-connectorBot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

ammario commented Sep 21, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

ammario commented Sep 21, 2025

Summary

The Vulnerability

The Fix

Testing

Verification

Uh oh!

chatgpt-codex-connectorBot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

ammario commented Sep 21, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

ammario commented Sep 21, 2025

Summary

The Vulnerability

The Fix

Testing

Verification

Uh oh!

chatgpt-codex-connectorBot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

ammario commented Sep 21, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

ammario commented Sep 21, 2025

Summary

The Vulnerability

The Fix

Testing

Verification