@Ln1m/dsh-tool-suite

The 3081 proxy is bound to 0.0.0.0 (line 30/405) and rewrites Host/Origin back to 127.0.0.1:3080, so upstream sees a loopback-authoritative request. When any client performs a plain GET with 'Accept: text/html' and no token, the upstream 401 is converted into a 302 whose Location carries the process launch token. Any host that can reach port 3081 (same Wi-Fi/LAN, hotel or public network, port-forward) therefore obtains the DSH web session token, and with it full access to the agent UI including tool/command execution as the logged-in user. The comment 'token 不外泄' (no token leakage to LAN) is n

expandCommand() (line 289 / 134-143) substitutes the first matched absolute path verbatim into the rule template, and the result is run through a shell. A file whose name contains shell metacharacters (e.g. '; rm -rf ...' or $(...)) inside a watched root such as ~/DeepSeek_harness would be executed as part of the hook command. Preconditions are real but narrow: a hook rule containing {file}/{dir}/{proj} must be configured in ~/.dsh/guard-hooks.json (a local, user-writable file that is not shipped here) and the attacker must be able to create such a file inside the scan roots. The rule text its

POST /wifi-access/api/client-caps concatenates the whole request body into a string before attempting JSON.parse, with no size limit. Because the built-in 3081 proxy forwards LAN requests to the host web server, an unauthenticated LAN peer (which, per the first finding, can also obtain a token) can push arbitrarily large bodies and exhaust host-process memory. Only the resulting log file is capped at 512 KB; the in-memory buffer is not.

Registering these handlers at module load affects the whole DSH host process, not just this plugin: uncaught exceptions that would normally terminate the process are downgraded to a console line, leaving the host running in an undefined state and hiding faults introduced by other plugins. Also, it is a side effect at import time rather than inside apply(), so it persists even if the plugin is disabled.