Description

fetchWithTimeoutGuarded() now auto-selects mode: trusted_env_proxy whenever an HTTP(S) proxy is present in the environment (unless dispatcherPolicy is set or NO_PROXY matches). In trusted_env_proxy mode, fetchWithSsrFGuard() skips resolvePinnedHostnameWithPolicy() entirely and directly instantiates EnvHttpProxyAgent.

Impact:

• SSRF policy checks are bypassed (blocked hostnames like metadata.google.internal, localhost/internal TLDs, and private/special-use IP literal checks), because those checks live in resolvePinnedHostnameWithPolicy().
• If the target URL is attacker-controlled (directly, or via a redirect chain), an attacker can potentially fetch internal resources (or cloud metadata) through the configured proxy.
• If an attacker can influence process environment variables (e.g., multi-tenant/plugin environments, compromised runtime config), setting HTTP_PROXY/HTTPS_PROXY to an attacker-controlled proxy can route outbound provider requests through that proxy (credential/token exfiltration / MITM).

Vulnerable code paths:

• Auto-upgrade based on env in fetchWithTimeoutGuarded()
• SSRF checks skipped in fetchWithSsrFGuard() when mode === trusted_env_proxy

Vulnerable code:

​// shared.ts
const resolvedMode = options?.mode ?? (
  shouldAutoUpgradeToTrustedEnvProxy({ url, dispatcherPolicy: options?.dispatcherPolicy })
    ? GUARDED_FETCH_MODE.TRUSTED_ENV_PROXY
    : undefined
);
...
...(resolvedMode ? { mode: resolvedMode } : {}),

​// fetch-guard.ts
const canUseTrustedEnvProxy =
  mode === GUARDED_FETCH_MODE.TRUSTED_ENV_PROXY && hasProxyEnvConfigured();
if (canUseTrustedEnvProxy) {
  dispatcher = createHttp1EnvHttpProxyAgent();
} else if (params.pinDns === false) {
  await resolvePinnedHostnameWithPolicy(parsedUrl.hostname, ...);
  ...
} else {
  const pinned = await resolvePinnedHostnameWithPolicy(parsedUrl.hostname, ...);
  ...
}

Recommendation

Do not allow trusted_env_proxy to fully bypass SSRF validation for caller-supplied URLs.

Options (pick one, in order of safety):

1. Require explicit opt-in (no auto-upgrade): only use mode: "trusted_env_proxy" when the caller explicitly passes it.

2. If auto-upgrade is required for reliability, still enforce pre-proxy SSRF validation in trusted-env mode:

   • Run resolvePinnedHostnameWithPolicy(parsedUrl.hostname, ...) (or at minimum assertAllowedHostOrIpOrThrow-equivalent checks) even when using EnvHttpProxyAgent.
   • If DNS pinning is incompatible with proxies, keep the hostname/IP blocklist and allowlist checks, but skip only the pinning aspect.

Example sketch:

​// In fetchWithSsrFGuard()
if (mode === GUARDED_FETCH_MODE.TRUSTED_ENV_PROXY) {
  ​// Still block obvious SSRF targets
  await resolvePinnedHostnameWithPolicy(parsedUrl.hostname, {
    lookupFn: params.lookupFn,
    policy: params.policy,
  });
  ​// Then dispatch via env proxy without pinning
  dispatcher = createHttp1EnvHttpProxyAgent();
}

3. Constrain auto-upgrade to known-safe destinations (e.g., provider allowlists), so user-controlled URLs cannot enter trusted_env_proxy mode.

Also document clearly that HTTP_PROXY/HTTPS_PROXY must be treated as operator-controlled configuration, not user input.