dsh-route-fence-linter
静态检查器：每个插件 HTTP 路由都必须带有浏览器信任防护栏（在 Origin / sec-fetch-site 之前固定回环 Host）。
插件会安装到这里；不确定时保持 web。
npx -y @deepseek-ai/dsh plugin --profile web add github:Vladimir-Kryshchenko/dsh-route-fence-linter#cef3b0395e818156115b7ee27da160d9fa765601Route Fence Linter 以 dsh-route-fence-linter 发布，当前版本为 0.1.0。Plugin Hub 会校验它的 manifest，并保存精确安装来源，便于复现安装结果。
Every plugin route registered on webServer is dispatched by longest-prefix
match, ahead of the host's /api gateway — so it never passes the gateway's
unified trust check. Each plugin author must ship their own browser-trust
fence, and most do not. This linter finds the ones that did not.
dsh-route-fence scan # $DSH_HOME/profiles/web
dsh-route-fence scan /path/to/profile
Exit codes: 0 clean · 1 at least one FAIL · 2 usage/IO error.
| Verdict | Meaning |
|---|---|
PASS | The handler gates on a fence that pins the Host before Origin handling. |
WARN | Inside the fence, Origin / sec-fetch-site is read before the Host is pinned. Confirm the ordering by hand. |
FAIL | One of: no Host check anywhere; a fence that compares Origin to Host but never pins the Host to loopback (bypassable by DNS rebinding — the attacker controls both headers and they match); or a fence that exists but this handler never calls. |
Bundles whose sources cannot be read are reported as SKIP and counted in the
summary — a skipped bundle is not a clean bundle.
The scan covers what a package publishes (its package.json files field);
a package that declares no files is scanned whole. Anything excluded is named
in the output as a note line, never dropped silently.
Scoping by directory name was tried and reverted: skipping anything called
tests/ or examples/ would have let a plugin hide an unfenced route in a
directory with that name and be reported clean. Publication scope cannot be
gamed that way — the loader can only import what was installed.
The rebinding-bypassable shape is graded FAIL, not WARN: it was found live
in a real, widely-installed plugin and confirmed exploitable against a running
profile — a request with Host: evil.example and Origin: http://evil.example
passed the check and executed a state-changing method.
The shape the host itself uses (and dsh-better-sidebar/src/trust-fence.ts
copies): pin the Host header to loopback or a configured trusted authority
first, refuse cross-site fetch markers, and only then compare Origin.
Comparing Origin before pinning the Host is not a fence.
Heuristic over source text, not dataflow analysis. A fence is identified as the smallest function body that both references the Host and constrains it; a handler counts as gated when it calls that fence, receives it as a value, or performs the check inline. This recognises the reference implementation, the threaded-fence pattern, and helper-based Host reads — but a sufficiently indirect fence can still be missed. Report false verdicts; they are bugs.