From 030e3149446f12fe603555702cad878bb96626be Mon Sep 17 00:00:00 2001 From: Landon Cox Date: Mon, 4 May 2026 20:07:16 -0700 Subject: [PATCH 1/2] fix: unexport internal helpers from ssl-bump and host-iptables MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - Remove export from mountSslTmpfs (ssl-bump.ts) — only used internally - Remove export from getDockerBridgeGateway (host-iptables.ts) — only used internally - Move _resetIpv6State behind __testing namespace — removes direct export of test-only mutable state reset from security-critical module Closes #2524 Closes #2531 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- src/host-iptables.test.ts | 4 ++-- src/host-iptables.ts | 7 +++++-- src/ssl-bump.ts | 2 +- 3 files changed, 8 insertions(+), 5 deletions(-) diff --git a/src/host-iptables.test.ts b/src/host-iptables.test.ts index 85c67c778..8fadd359f 100644 --- a/src/host-iptables.test.ts +++ b/src/host-iptables.test.ts @@ -1,4 +1,4 @@ -import { ensureFirewallNetwork, setupHostIptables, cleanupHostIptables, cleanupFirewallNetwork, _resetIpv6State, HostAccessConfig, isValidPortSpec } from './host-iptables'; +import { ensureFirewallNetwork, setupHostIptables, cleanupHostIptables, cleanupFirewallNetwork, __testing, HostAccessConfig, isValidPortSpec } from './host-iptables'; import execa from 'execa'; // Mock execa @@ -24,7 +24,7 @@ jest.mock('./logger', () => ({ describe('host-iptables', () => { beforeEach(() => { jest.clearAllMocks(); - _resetIpv6State(); + __testing._resetIpv6State(); }); describe('ensureFirewallNetwork', () => { diff --git a/src/host-iptables.ts b/src/host-iptables.ts index 2f8c86c45..670f9c92f 100644 --- a/src/host-iptables.ts +++ b/src/host-iptables.ts @@ -56,11 +56,14 @@ let ipv6DisabledViaSysctl = false; /** * Resets internal IPv6 state (for testing only). */ -export function _resetIpv6State(): void { +function _resetIpv6State(): void { ip6tablesAvailableCache = null; ipv6DisabledViaSysctl = false; } +// Exposed for testing only — not part of public API +export const __testing = { _resetIpv6State }; + /** * Gets the bridge interface name for the firewall network */ @@ -85,7 +88,7 @@ async function getNetworkBridgeName(): Promise { * Gets the Docker default bridge gateway IP (e.g., 172.17.0.1). * This is the IP that host.docker.internal resolves to inside containers. */ -export async function getDockerBridgeGateway(): Promise { +async function getDockerBridgeGateway(): Promise { try { const { stdout } = await execa('docker', [ 'network', 'inspect', 'bridge', diff --git a/src/ssl-bump.ts b/src/ssl-bump.ts index 568fd31cb..76e7acb42 100644 --- a/src/ssl-bump.ts +++ b/src/ssl-bump.ts @@ -52,7 +52,7 @@ export interface CaFiles { * @param sslDir - Directory path to mount tmpfs on * @returns true if tmpfs was mounted, false if fallback to disk */ -export async function mountSslTmpfs(sslDir: string): Promise { +async function mountSslTmpfs(sslDir: string): Promise { try { // Mount tmpfs with restrictive options (4MB is more than enough for SSL keys) await execa('mount', [ From d70107f9dc10c4d194314f58ee97786e31c6c181 Mon Sep 17 00:00:00 2001 From: Landon Cox Date: Mon, 4 May 2026 20:12:38 -0700 Subject: [PATCH 2/2] Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> --- src/host-iptables.ts | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/src/host-iptables.ts b/src/host-iptables.ts index 670f9c92f..c328c2dc1 100644 --- a/src/host-iptables.ts +++ b/src/host-iptables.ts @@ -61,8 +61,10 @@ function _resetIpv6State(): void { ipv6DisabledViaSysctl = false; } -// Exposed for testing only — not part of public API -export const __testing = { _resetIpv6State }; +/** + * @internal Exported for testing. + */ +export const __testing = Object.freeze({ _resetIpv6State }); /** * Gets the bridge interface name for the firewall network