From 575ce14b14bffdae5568e54a0917f09afe9d5947 Mon Sep 17 00:00:00 2001 From: Evgen Bielozorov Date: Wed, 2 Sep 2026 19:21:29 +0200 Subject: [PATCH] fix(q): restrict .q.connect/.q.send/.q.close under -U IPC Register the outbound q-wire builtins with RAY_FN_RESTRICTED instead of RAY_FN_NONE. Without the flag, a -U native IPC client could call .q.connect and force the server to open arbitrary outbound q-wire connections (SSRF-style); .q.send and .q.close were likewise unguarded. The core enforcement gate (lang/eval.c: __VM->restricted && (fn_obj->attrs & RAY_FN_RESTRICTED)) now blocks these verbs for restricted IPC clients, while full-privilege local/embedded callers are unaffected. --- embed/rayforce_q.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/embed/rayforce_q.c b/embed/rayforce_q.c index a75cefd..ec886da 100644 --- a/embed/rayforce_q.c +++ b/embed/rayforce_q.c @@ -199,15 +199,15 @@ static void q_bind(const char *name, ray_t *fn) { void q_env_register(void) { ray_t *f; - f = ray_fn_vary(".q.connect", RAY_FN_NONE, qb_connect); + f = ray_fn_vary(".q.connect", RAY_FN_RESTRICTED, qb_connect); q_bind(".q.connect", f); ray_release(f); - f = ray_fn_binary(".q.send", RAY_FN_NONE, qb_send); + f = ray_fn_binary(".q.send", RAY_FN_RESTRICTED, qb_send); q_bind(".q.send", f); ray_release(f); - f = ray_fn_unary(".q.close", RAY_FN_NONE, qb_close); + f = ray_fn_unary(".q.close", RAY_FN_RESTRICTED, qb_close); q_bind(".q.close", f); ray_release(f); }