oauthex: oauth discovery checks (#1220)

add extra checks for the default oauth discovery client:
* disallow redirects which downgrade to http
* disallow redirects to localhost or private ip
* disallow the initial call to a private ip
* proxy configuration opts out of dial time checking

oauthex/oauth2.go

@@ -11,14 +11,22 @@ import (
 	"fmt"
 	"io"
 	"mime"
+	"net"
 	"net/http"
+	"net/netip"
 	"net/url"
 	"strings"
+	"syscall"
+	"time"
 
 	"github.com/modelcontextprotocol/go-sdk/internal/json"
 	"github.com/modelcontextprotocol/go-sdk/internal/util"
 )
 
+const maxDiscoveryRedirects = 10
+
+var defaultDiscoveryTransport = newDiscoveryTransport(http.DefaultTransport)
+
 type httpStatusError struct {
 	StatusCode int
 }
@@ -35,10 +43,7 @@ func getJSON[T any](ctx context.Context, c *http.Client, url string, limit int64
 	if err != nil {
 		return nil, err
 	}
-	if c == nil {
-		c = http.DefaultClient
-	}
-	res, err := c.Do(req)
+	res, err := newDiscoveryClient(c).Do(req)
 	if err != nil {
 		return nil, err
 	}
@@ -91,5 +96,112 @@ func checkHTTPSOrLoopback(addr string) error {
 	if !util.IsLoopback(u.Host) && u.Scheme != "https" {
 		return fmt.Errorf("URL %q does not use HTTPS or is not a loopback address", addr)
 	}
+	if ip, err := netip.ParseAddr(u.Hostname()); err == nil && util.IsPrivateOrReserved(ip) {
+		return fmt.Errorf("URL %q refers to a non-public address", addr)
+	}
+	return nil
+}
+
+func newDiscoveryClient(c *http.Client) *http.Client {
+	transport := defaultDiscoveryTransport
+	if c != nil && c.Transport != nil {
+		// a caller that has taken over dialing or TLS opts out of the checks
+		if t, ok := c.Transport.(*http.Transport); ok && t.DialContext == nil && t.DialTLSContext == nil {
+			transport = newDiscoveryTransport(t)
+		} else {
+			transport = c.Transport
+		}
+	}
+	discoveryClient := &http.Client{
+		Transport: transport,
+
+		CheckRedirect: func(req *http.Request, via []*http.Request) error {
+			if c != nil && c.CheckRedirect != nil {
+				return c.CheckRedirect(req, via)
+			}
+			if len(via) >= maxDiscoveryRedirects {
+				return fmt.Errorf("max redirects exceeded (%d)", maxDiscoveryRedirects)
+			}
+			if prev := via[len(via)-1]; prev.URL.Scheme == "https" && req.URL.Scheme != "https" {
+				return fmt.Errorf("redirect to non-HTTPS scheme %q is a security downgrade", req.URL.Scheme)
+			}
+			return checkLoopbackRedirect(req.Context(), req.URL.Hostname())
+		},
+	}
+	if c != nil {
+		discoveryClient.Timeout = c.Timeout
+		discoveryClient.Jar = c.Jar
+	}
+	return discoveryClient
+}
+
+// newDiscoveryTransport creates an http.RoundTripper with extra protections enabled,
+// unless the provided RoundTripper is not *http.Transport.
+func newDiscoveryTransport(rt http.RoundTripper) http.RoundTripper {
+	base, ok := rt.(*http.Transport)
+	if !ok {
+		return rt
+	}
+	// If a proxy is configured Control checks should be disabled, because they will
+	// basically be running for proxy dials.
+	if proxyConfigured(base) {
+		return rt
+	}
+	result := base.Clone()
+	result.DialContext = (&net.Dialer{
+		Timeout:   30 * time.Second,
+		KeepAlive: 30 * time.Second,
+		Control: func(_, address string, _ syscall.RawConn) error {
+			host, _, err := net.SplitHostPort(address)
+			if err != nil {
+				host = address
+			}
+			ip, err := netip.ParseAddr(host)
+			if err != nil {
+				return fmt.Errorf("non-ip address: %w", err)
+			}
+			if util.IsPrivateOrReserved(ip) {
+				return fmt.Errorf("non-public ip address: %q", ip)
+			}
+			return nil
+		},
+	}).DialContext
+	return result
+}
+
+func proxyConfigured(t *http.Transport) bool {
+	if t.Proxy == nil {
+		return false
+	}
+	req, err := http.NewRequest(http.MethodGet, "https://check-proxy-existence.com", nil)
+	if err != nil {
+		return false
+	}
+	u, err := t.Proxy(req)
+	return err == nil && u != nil
+}
+
+func checkLoopbackRedirect(ctx context.Context, host string) error {
+	doCheck := func(ip netip.Addr) error {
+		if ip.Unmap().IsLoopback() {
+			return fmt.Errorf("redirect into loopback address %q", host)
+		}
+		if util.IsPrivateOrReserved(ip) {
+			return fmt.Errorf("redirect into non-public address %q", host)
+		}
+		return nil
+	}
+	if ip, err := netip.ParseAddr(host); err == nil {
+		return doCheck(ip)
+	}
+	ips, err := net.DefaultResolver.LookupNetIP(ctx, "ip", host)
+	if err != nil {
+		return fmt.Errorf("cannot resolve redirect host %q: %w", host, err)
+	}
+	for _, ip := range ips {
+		if err := doCheck(ip); err != nil {
+			return err
+		}
+	}
 	return nil
 }