1.) Don't allow agent auth to be disabled if running in prod

2.) fix ssrf in the fetch url
3.) fix path traversal vuln when uploading files
4.) added rate limiting to web socket upgrading (very needed)
5.) make token revocation from 5 seconds to 500 ms.

Overlord-Server/src/server/routes/deploy-routes.ts

@@ -113,6 +113,20 @@ export async function handleDeployRoutes(
       return new Response("Only http and https URLs are allowed", { status: 400 });
     }
 
+    const hostname = parsed.hostname.toLowerCase();
+    const BLOCKED_HOSTS = ["localhost", "metadata.google.internal", "169.254.169.254"];
+    if (
+      BLOCKED_HOSTS.includes(hostname) ||
+      hostname.endsWith(".internal") ||
+      hostname.startsWith("127.") ||
+      hostname === "[::1]" ||
+      /^(10\.|172\.(1[6-9]|2\d|3[01])\.|192\.168\.)/.test(hostname) ||
+      hostname.startsWith("169.254.") ||
+      hostname.startsWith("0.")
+    ) {
+      return new Response("URLs pointing to private/internal addresses are not allowed", { status: 400 });
+    }
+
     const rawFilename = path.basename(parsed.pathname) || "download.bin";
     const filename = rawFilename.replace(/[^a-zA-Z0-9._\-]/g, "_").substring(0, 128) || "download.bin";