fix(mcp): add SSRF protection to OAuth metadata discovery

The OAuth discovery flow in oauth-utils.ts and oauth-provider.ts
fetches URLs received directly from external MCP server responses
without any SSRF validation, unlike web-fetch.ts which already
uses isLoopbackHost() and resolveAndValidateDns() from utils/fetch.ts.

A malicious MCP server can return private/internal IPs in:
- WWW-Authenticate: Bearer resource_metadata="http://169.254.169.254/..."
- /.well-known/oauth-protected-resource: {authorization_servers: ["http://169.254.169.254"]}
- /.well-known/oauth-authorization-server: {registration_endpoint: "http://10.x.x.x/admin"}

This causes gemini-cli to make GET and POST requests to cloud IMDS
endpoints (AWS 169.254.169.254, GCP metadata.google.internal, Azure
169.254.169.254) or internal services on the developer's network.

Fix: apply the same isLoopbackHost() + resolveAndValidateDns() guards
already used in web-fetch.ts to:
- OAuthUtils.fetchProtectedResourceMetadata()
- OAuthUtils.fetchAuthorizationServerMetadata()
- MCPOAuthProvider.registerClient()

Author: herdiyana256

packages/core/src/mcp/oauth-provider.ts

@@ -14,6 +14,7 @@ import { OAuthUtils, ResourceMismatchError } from './oauth-utils.js';
 import { coreEvents } from '../utils/events.js';
 import { debugLogger } from '../utils/debugLogger.js';
 import { getConsentForOauth } from '../utils/authConsent.js';
+import { isLoopbackHost, resolveAndValidateDns } from '../utils/fetch.js';
 import {
   generatePKCEParams,
   startCallbackServer,
@@ -111,6 +112,18 @@ export class MCPOAuthProvider {
       scope: config.scopes?.join(' ') || '',
     };
 
+    const parsedRegUrl = new URL(registrationUrl);
+    if (isLoopbackHost(parsedRegUrl.hostname)) {
+      throw new Error(
+        `Client registration blocked: loopback address not allowed: ${registrationUrl}`,
+      );
+    }
+    const resolvedAddrs = await resolveAndValidateDns(registrationUrl);
+    if (resolvedAddrs.length === 0) {
+      throw new Error(
+        `Client registration blocked: private/reserved IP not allowed: ${registrationUrl}`,
+      );
+    }
     const response = await fetch(registrationUrl, {
       method: 'POST',
       headers: {

packages/core/src/mcp/oauth-utils.ts

@@ -7,6 +7,10 @@
 import type { MCPOAuthConfig } from './oauth-provider.js';
 import { getErrorMessage } from '../utils/errors.js';
 import { debugLogger } from '../utils/debugLogger.js';
+import {
+  isLoopbackHost,
+  resolveAndValidateDns,
+} from '../utils/fetch.js';
 
 /**
  * Error thrown when the discovered resource metadata does not match the expected resource.
@@ -97,6 +101,20 @@ export class OAuthUtils {
     resourceMetadataUrl: string,
   ): Promise<OAuthProtectedResourceMetadata | null> {
     try {
+      const parsedUrl = new URL(resourceMetadataUrl);
+      if (isLoopbackHost(parsedUrl.hostname)) {
+        debugLogger.debug(
+          `Blocked OAuth metadata fetch to loopback address: ${resourceMetadataUrl}`,
+        );
+        return null;
+      }
+      const resolvedAddrs = await resolveAndValidateDns(resourceMetadataUrl);
+      if (resolvedAddrs.length === 0) {
+        debugLogger.debug(
+          `Blocked OAuth metadata fetch to private/reserved IP: ${resourceMetadataUrl}`,
+        );
+        return null;
+      }
       const response = await fetch(resourceMetadataUrl);
       if (!response.ok) {
         return null;
@@ -121,6 +139,20 @@ export class OAuthUtils {
     authServerMetadataUrl: string,
   ): Promise<OAuthAuthorizationServerMetadata | null> {
     try {
+      const parsedUrl = new URL(authServerMetadataUrl);
+      if (isLoopbackHost(parsedUrl.hostname)) {
+        debugLogger.debug(
+          `Blocked OAuth metadata fetch to loopback address: ${authServerMetadataUrl}`,
+        );
+        return null;
+      }
+      const resolvedAddrs = await resolveAndValidateDns(authServerMetadataUrl);
+      if (resolvedAddrs.length === 0) {
+        debugLogger.debug(
+          `Blocked OAuth metadata fetch to private/reserved IP: ${authServerMetadataUrl}`,
+        );
+        return null;
+      }
       const response = await fetch(authServerMetadataUrl);
       if (!response.ok) {
         return null;