@alienzhou/html-workbench

send_asset joins the attacker-controlled path segment onto the directory of an .html file decoded from the URL token and resolves it with no containment check. A request such as GET http://127.0.0.1:4317/assets/<base64 of any existing .html>/../../../../home/user/.ssh/id_rsa returns the file bytes with a guessed content type. The token only has to name one existing .html file, which is trivially available (the file being edited, or any known page). Reachable by any local process and, via DNS rebinding, by a web page, since the service sends no CORS headers and validates no Host.

read_json_body parses the body without validating Content-Type, and no handler checks Origin or Host. POST /api/anchor (which rewrites arbitrary .html files) and POST /api/shutdown therefore accept 'simple' cross-origin POSTs from any web page the user visits, and the DSH web route /html-workbench/restart is registered as an unauthenticated GET whose handler kills and respawns the service. This turns the design assumption 'loopback means trusted' into a CSRF / DNS-rebinding surface: file modification of a known .html path and service denial are possible without any user intent.

stop_service enumerates PIDs listening on the port with lsof/netstat and kills every one that is not itself (os.kill SIGTERM or taskkill /T /F) without confirming the listener is html-workbench — this branch is entered precisely when health() did not answer, i.e. the process is most likely not the workbench. It is triggered by the host's restartService and by the unauthenticated /html-workbench/restart route, so an unrelated development server that happens to use port 4317 can be force-killed.