{"record":{"id":"7c95c6b372379031","repo":"affaan-m/ECC","slug":"unknown-catalog-command-options-command","errorCode":null,"errorMessage":"Unknown catalog command: ${options.command}","messagePattern":"Unknown catalog command: (.+?)","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"scripts/catalog.js","lineNumber":179,"sourceCode":"        printComponents(components);\n      }\n      return;\n    }\n\n    if (options.command === 'show') {\n      if (!options.componentId) {\n        throw new Error('Catalog show requires an install component ID');\n      }\n      const component = getInstallComponent(options.componentId);\n      if (options.json) {\n        console.log(JSON.stringify(component, null, 2));\n      } else {\n        printComponent(component);\n      }\n      return;\n    }\n\n    throw new Error(`Unknown catalog command: ${options.command}`);\n  } catch (error) {\n    console.error(`Error: ${error.message}`);\n    process.exit(1);\n  }\n}\n\nmain();\n","sourceCodeStart":161,"sourceCodeEnd":187,"githubUrl":"https://github.com/affaan-m/ECC/blob/01e15490f04e29cfefe3896951f43db46994d8ee/scripts/catalog.js#L161-L187","documentation":"SSRF guard inside _validate_import_url(): after resolving the hostname, the validator iterates every returned address and rejects the import if ANY resolved IP is private, loopback, link-local, multicast, reserved, or unspecified. This blocks attempts to reach internal services — including the cloud metadata endpoint 169.254.169.254, localhost, and RFC1918 ranges — through the remote-import feature. The check is on all resolved addresses so a DNS rebinding attack (public first, private second) is still caught.","triggerScenarios":"Importing from a URL whose host resolves to 127.0.0.1, 10.0.0.1, 169.254.169.254 (cloud metadata), 192.168.x.x, or 0.0.0.0; an internal corporate hostname that points to a private range; a DNS rebinding payload.","commonSituations":"Pointing at a localhost dev server; an internal tool hostname; a maliciously crafted URL designed to reach internal metadata services; testing against 0.0.0.0.","solutions":["Use a genuinely public host whose DNS records resolve to public IPs only.","For trusted internal content, download the file manually on a connected machine and import it via its local filesystem path.","If you operate the host, ensure its public DNS does not return private-range addresses."],"exampleFix":"# before\n_validate_import_url('https://localhost/instinct.md')  # 127.0.0.1 rejected\n\n# after — import the local file directly instead\n_validate_file_path('./instincts/downloaded.md', must_exist=True)","handlingStrategy":"validation","validationCode":"# Pre-check that the host resolves only to public IPs (mirror the guard).\nimport socket, ipaddress, urllib.parse\nparsed = urllib.parse.urlparse(source)\nfor _fam, *_rest, sockaddr in socket.getaddrinfo(parsed.hostname, 443, type=socket.SOCK_STREAM):\n    ip = ipaddress.ip_address(sockaddr[0])\n    if ip.is_private or ip.is_loopback or ip.is_link_local or ip.is_reserved or ip.is_unspecified:\n        raise SystemExit(f'{source} resolves to a non-public address {ip} — import blocked')","typeGuard":"import socket, ipaddress, urllib.parse\n\ndef resolves_to_public_only(host) -> bool:\n    for *_rest, sockaddr in socket.getaddrinfo(host, 443, type=socket.SOCK_STREAM):\n        ip = ipaddress.ip_address(sockaddr[0])\n        if ip.is_private or ip.is_loopback or ip.is_link_local or ip.is_reserved or ip.is_unspecified:\n            return False\n    return True","tryCatchPattern":"try:\n    content = _fetch_import_url(source)\nexcept ValueError as e:\n    if 'non-public address' in str(e):\n        log.error('SSRF guard blocked %s — use a public host or import locally', source)\n    raise","preventionTips":["Never point the import feature at localhost, 127.0.0.1, or RFC1918 addresses.","Be especially careful with cloud metadata endpoints (169.254.169.254).","For internal content, download on a trusted machine and import the local file."],"tags":["security","ssrf","network","validation","dns"],"backgroundTag":null,"analyzedSha":"01e15490f04e29cfefe3896951f43db46994d8ee","analyzedAt":"2026-08-13T00:31:08.655Z","schemaVersion":2},"datasetVersion":"2026-08-13T04:17:16.726Z"}