T03 · Remote Payload Retrieval and Execution
Error
- Location
embedding/embedder-loader.ts:124- Finding
Unauthenticated Remote Embedder Bundle Is Downloaded and Dynamically Executed
- Content
View full analysis
api.logger.info(msg) }) .then((result) => { api.logger.info( `TotalReclaw: embedder prefetch ${ result === 'fetched' ? 'completed (downloaded bundle)' : 'cache hit' }`, ); }) .catch((err: unknown) => { const msg = err instanceof Error ? err.message : String(err); api.logger.warn( `TotalReclaw: embedder prefetch failed ` + `(non-fatal — will retry on first generateEmbedding): ${msg}`, ); }); } ``` ```ts // embedding/embedder-network.ts export const DEFAULT_BUNDLE_URL_TEMPLATE = 'https://github.com/p-diogo/totalreclaw/releases/download/v{rcTag}/embedder-{bundleVersion}.tar.gz'; export const DEFAULT_MANIFEST_URL_TEMPLATE = 'https://github.com/p-diogo/totalreclaw/releases/download/v{rcTag}/embedder-{bundleVersion}.manifest.json'; ``` ```ts // embedding/embedder-loader.ts const rawManifest = await fetchManifestJson(manifestUrl, { fetchImpl: opts.fetchImpl, log, timeoutMs: opts.manifestTimeoutMs ?? 60_000, }); if (!isValidManifestShape(rawManifest)) { throw new Error(`embedder manifest at ${manifestUrl} failed shape validation`); } const manifest = rawManifest as BundleManifest; await downloadAndExtractTarGz( bundleUrl, layout.versionRoot, manifest.tarball_sha256, { fetchImpl: opts.fetchImpl, log, timeoutMs: opts.bundleTimeoutMs ?? 600_000, }, ); ``` ```ts // embedding/embedder-loader.ts const fileUrl = pathToFileURL(esmEntry).href; const mod = await import(fileUrl); return normalizeImportNamespace(mod, specifi ...[truncated 2528 chars]- Remediation
View remediation