dsh-unified-market

The guard only compares the Origin header host with the request Host header, both of which are attacker-chosen for a non-browser client and are equal for a hostile page reached via DNS rebinding to 127.0.0.1. Once past it, install/update forward body.binPath into startOp -> dshInvoke -> invokeEntry, which returns { file: process.execPath, args: [...process.execArgv, ...loader, entry] } — i.e. the server runs `node <attacker-chosen file>`. An arbitrary `github:`/`link:` install spec likewise runs that package's install scripts with the full process env.

install/uninstall/update/kill/profile.toggle/setAutoUpdate/updateAll all call sameOrigin(req) first, but pack.inspect, pack.rollback, pack.export and pack.scan do not. A cross-site fetch (no-cors POST with a text/plain JSON body) can therefore drive the feature-pack CLI: pack.inspect writes up to 128 MB of attacker base64 into ~/.dsh/feature-packs/.uploads and runs `inspect` on an attacker URL/path; pack.rollback mutates installed feature packs. No response read is needed for the side effect to land.

`id` comes straight from body.id with only .trim(). A value such as '../../../../tmp/x' resolves outside DSH_HOME, so the CLI export is written to an attacker-chosen location (content and '.dshpack-<ts>' suffix are constrained, and an unknown id will usually make the export fail, so this is a hardening gap rather than a demonstrated arbitrary write). The same branch also lacks an origin check.

readBody concatenates the entire body into a string with no size cap, and the pack upload path only enforces its 128 MB limit after the whole base64 payload has been buffered and decoded. A reachable client can exhaust host memory (and fill ~/.dsh/feature-packs/.uploads) with a single large POST.

fetchCandidateInfo turns `link:`/`file:` input into an absolute path (`~` expansion, absolute paths used verbatim) and reads package.json / cordis.patch.yml there. It is reached by the `scan` method, which has no sameOrigin check, so any local HTTP client can probe the filesystem and learn whether a directory holds a package manifest (contents are only surfaced indirectly through the scan verdict/error text).