fix: fix security issue in runner.js

[anupamme]

Summary

Fix high severity security issue in lib/runner.js.

Vulnerability

Field	Value
ID	V-001
Severity	HIGH
Scanner	multi_agent_ai
Rule	V-001
File	lib/runner.js:37
Assessment	Likely exploitable

Description: The application fetches remote CSS files via user-supplied URLs without any validation. The URL is taken directly from the --url CLI argument and passed to node-fetch without protocol restrictions, private IP range blocking, or localhost filtering.

Evidence

Exploitation scenario: Run: analyze-css --url 'http://169.254.169.254/latest/meta-data/iam/security-credentials/' to access AWS metadata, or analyze-css --url 'http://localhost:6379/' to access internal Redis services.

Scanner confirmation: multi_agent_ai rule V-001 flagged this pattern.

Production code: This file is in the production codebase, not test-only code.

Threat Model Context

This is a Node.js library - vulnerabilities affect downstream consumers who use this package.

Changes

• lib/runner.js

Behavior Preservation

The change is scoped to 1 file on the vulnerable path.

Security Invariant

Property: The security boundary is maintained under adversarial input

Regression test

const runner = require("../lib/runner");

describe("security boundary is maintained under adversarial input", () => {
  const payloads = [
    "http://localhost:22/admin",           // localhost access
    "http://169.254.169.254/latest/meta-data/", // cloud metadata
    "file:///etc/passwd",                   // file protocol
    "http://192.168.1.1:8080/internal",     // private IP
    "https://example.com/valid.css"         // valid input (should work or be rejected safely)
  ];

  test.each(payloads)("rejects or safely handles: %s", async (payload) => {
    const options = { url: payload };
    
    // The security property: runner must not fetch from dangerous URLs
    // It should either reject/throw, or resolve without making the request
    await expect(
      new Promise((resolve, reject) => {
        runner(options, (err, result) => {
          if (err) reject(err);
          else resolve(result);
        });
      })
    ).rejects.toThrow();
  });
});

This test guards against regressions — it's useful independent of the code change above.

---

Automated security fix by OrbisAI Security