fix(allium-x402): fetch the installer over HTTPS (LABS-255) - #94
Open
kevarifin14 wants to merge 1 commit into
Open
fix(allium-x402): fetch the installer over HTTPS (LABS-255)#94kevarifin14 wants to merge 1 commit into
kevarifin14 wants to merge 1 commit into
Conversation
The documented install was 'curl -sSL http://agents.allium.so/cli/install.sh | sh' — a plaintext fetch piped straight into a shell, so anyone able to MITM that first hop gets arbitrary code execution on the user's machine. agents.allium.so already serves the script over HTTPS directly (verified: 200, no redirect). The http URL only 302s to https, which does not help: the redirect is discovered over plaintext, and by then an attacker on the path has already had the chance to answer instead. Left the two 'http://www.apple.com/DTDs/PropertyList-1.0.dtd' strings in moonpay-trading-automation and moonpay-price-alerts alone — those are plist DOCTYPE identifiers, not URLs that get fetched, and rewriting them would be wrong.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes LABS-255.
The documented install is a plaintext fetch piped straight into a shell:
Anyone able to MITM that first hop gets arbitrary code execution on the user's machine.
Why the existing redirect doesn't already cover it
agents.allium.sodoes 302http→https. That doesn't help: the redirect is discovered over plaintext, so an attacker on the path answers the first request instead of the real server, and| shruns whatever came back. The redirect only protects users who were never being attacked.Verified the direct HTTPS URL works, so there's no behaviour change for anyone else:
Two occurrences updated — the
install:frontmatter and the CLI row in the reference table.Deliberately not changed
grep http:// skills/also matches:skills/moonpay-trading-automation/SKILL.md:88skills/moonpay-price-alerts/SKILL.md:96Both are
http://www.apple.com/DTDs/PropertyList-1.0.dtdin plistDOCTYPEdeclarations. Those are XML public identifiers, not URLs that get fetched — rewriting them tohttpswould be wrong and could break plist parsing. Flagging so a future sweep doesn't "fix" them.Follow-up needed in the other repo
moonpay-cli/src/content/skills-manifest.jsonis generated from this repo (scripts/build-skills.tsreads../moonpay-skills) and currently embeds thehttp://string, which is what moonpay.com/skills serves. This PR alone does not fix the website — the manifest needs regenerating inmoonpay-clionce this merges. Happy to raise that PR then.