Skip to content

Commit 93071b9

Browse files
sunny-seclaude
andcommitted
fix(security): restrict network scope to ports 80 and 443
.all(ports: []) is semantically identical to .all() in SPM — empty array means "all ports allowed". Change to .all(ports: [80, 443]) to actually restrict the plugin to HTTP/HTTPS ports only, blocking port scanning and access to internal services on non-standard ports. Verified end-to-end: plugin downloads CLI v1.34.2 over port 443 and runs scan successfully with restricted scope. DEVA11Y-481 Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
1 parent ac99746 commit 93071b9

1 file changed

Lines changed: 1 addition & 1 deletion

File tree

Package.swift

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,7 @@ let package = Package(
1919
),
2020
permissions: [
2121
.allowNetworkConnections(
22-
scope: .all(ports: []),
22+
scope: .all(ports: [80, 443]),
2323
reason: "Please allow network connection permission to authenticate and run accessibility rules."
2424
),
2525
.writeToPackageDirectory(reason: "Please allow writing to package directory for logging.")

0 commit comments

Comments
 (0)