From 0633add19d704f9abc7b9c997653c3e449b9ca59 Mon Sep 17 00:00:00 2001 From: Tianyi Cui <53024+tianyicui@users.noreply.github.com> Date: Thu, 13 Aug 2026 15:10:12 +0800 Subject: [PATCH] fix(web): clarify wildcard host safety warning --- packages/bundle/web-app/src/startup.ts | 2 +- packages/bundle/web-app/tests/startup.spec.ts | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/packages/bundle/web-app/src/startup.ts b/packages/bundle/web-app/src/startup.ts index 26aa17eb46..55a4b40f2e 100644 --- a/packages/bundle/web-app/src/startup.ts +++ b/packages/bundle/web-app/src/startup.ts @@ -67,7 +67,7 @@ export function apply(ctx: Context): void { program.action(() => { const options = program.opts() if (options.host === '0.0.0.0') { - program.error('error: --host 0.0.0.0 is intentionally not supported yet; use 127.0.0.1 instead') + program.error('error: --host 0.0.0.0 is intentionally not supported yet for safety: it would expose remote code execution to the network; use 127.0.0.1 instead') } if (options.port !== undefined && !/^\d+$/.test(options.port)) { program.error(`error: --port must be a number, got ${JSON.stringify(options.port)}`) diff --git a/packages/bundle/web-app/tests/startup.spec.ts b/packages/bundle/web-app/tests/startup.spec.ts index 29d02a423d..26e347a503 100644 --- a/packages/bundle/web-app/tests/startup.spec.ts +++ b/packages/bundle/web-app/tests/startup.spec.ts @@ -131,7 +131,7 @@ describe('web command-line provider', () => { it('rejects the intentionally unsupported all-interfaces host before the consumer activates', async () => { const { values, observed } = await bootProvider(['--host', '0.0.0.0']) - expect(observed.out).toContain('--host 0.0.0.0 is intentionally not supported yet; use 127.0.0.1 instead') + expect(observed.out).toContain('--host 0.0.0.0 is intentionally not supported yet for safety: it would expose remote code execution to the network; use 127.0.0.1 instead') expect(values).toBeUndefined() expect(observed.readerConfig).toBeUndefined() expect(observed.exits).toEqual([1])