Constrain OpenAPI server variable origins

[RhysSullivan]

What changed

• Validate OpenAPI server variable overrides before invocation.
• Reject unbounded server variables that change the request origin.
• Allow origin changes only when the selected variable value is explicitly enum-bounded by the spec.

Why

A broad OpenAPI server template such as https://{host} let a tool caller redirect authenticated invocations to arbitrary hosts.

Status

Skipped from the DeepSec batch merge in #1106. Left as a standalone draft for follow-up because this can affect legitimate tenant-host OpenAPI specs.

Validation

• Previous targeted validation passed before the batch decision.
• Needs a follow-up review of tenant-host compatibility before merge.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	executor-marketing	ba997aa	Commit Preview URL Branch Preview URL	Jun 23 2026, 06:18 PM

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
✅ Deployment successful! View logs	executor-cloud	ba997aa	Jun 23 2026, 06:20 PM

[github-actions]

Cloudflare preview

Torn down — the PR is closed.

[pkg-pr-new]

Open in StackBlitz

@executor-js/cli

npm i https://pkg.pr.new/@executor-js/cli@1104

@executor-js/config

npm i https://pkg.pr.new/@executor-js/config@1104

@executor-js/execution

npm i https://pkg.pr.new/@executor-js/execution@1104

@executor-js/sdk

npm i https://pkg.pr.new/@executor-js/sdk@1104

@executor-js/codemode-core

npm i https://pkg.pr.new/@executor-js/codemode-core@1104

@executor-js/runtime-quickjs

npm i https://pkg.pr.new/@executor-js/runtime-quickjs@1104

@executor-js/plugin-file-secrets

npm i https://pkg.pr.new/@executor-js/plugin-file-secrets@1104

@executor-js/plugin-graphql

npm i https://pkg.pr.new/@executor-js/plugin-graphql@1104

@executor-js/plugin-keychain

npm i https://pkg.pr.new/@executor-js/plugin-keychain@1104

@executor-js/plugin-mcp

npm i https://pkg.pr.new/@executor-js/plugin-mcp@1104

@executor-js/plugin-onepassword

npm i https://pkg.pr.new/@executor-js/plugin-onepassword@1104

@executor-js/plugin-openapi

npm i https://pkg.pr.new/@executor-js/plugin-openapi@1104

executor

npm i https://pkg.pr.new/executor@1104

commit: ba997aa