From bd0468beb32e621a5ded3a31d1211fd2122646f4 Mon Sep 17 00:00:00 2001
From: "google-labs-jules[bot]"
 <161369871+google-labs-jules[bot]@users.noreply.github.com>
Date: Tue, 22 Sep 2026 07:38:06 +0000
Subject: [PATCH 1/2] Fix web server binding vulnerability

Changed the `tiny_http::Server` to bind to `127.0.0.1` instead of
`0.0.0.0` in `stdlib/src/web.rs`. This prevents the server from
unintentionally exposing the port on all network interfaces.

Co-authored-by: Tcode-Motion <188012755+Tcode-Motion@users.noreply.github.com>
---
 stdlib/src/web.rs | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/stdlib/src/web.rs b/stdlib/src/web.rs
index 2c2040db..0f906818 100644
--- a/stdlib/src/web.rs
+++ b/stdlib/src/web.rs
@@ -403,7 +403,7 @@ impl StdlibRegistry {
                     }
                     SERVER_RUNNING.store(true, Ordering::SeqCst);
                     let server =
-                        Mutex::new(tiny_http::Server::http(format!("0.0.0.0:{}", port)).unwrap());
+                        Mutex::new(tiny_http::Server::http(format!("127.0.0.1:{}", port)).unwrap());
                     thread::spawn(move || {
                         while SERVER_RUNNING.load(Ordering::SeqCst) {
                             if let Ok(mut req) = server.lock().unwrap().recv() {
@@ -471,7 +471,7 @@ impl StdlibRegistry {
                     }
                     SERVER_RUNNING.store(true, Ordering::SeqCst);
                     let server =
-                        Mutex::new(tiny_http::Server::http(format!("0.0.0.0:{}", port)).unwrap());
+                        Mutex::new(tiny_http::Server::http(format!("127.0.0.1:{}", port)).unwrap());
                     thread::spawn(move || {
                         while SERVER_RUNNING.load(Ordering::SeqCst) {
                             if let Ok(mut req) = server.lock().unwrap().recv() {

From 69a54c643485dc11ebf82bb5368df69dcd10c8df Mon Sep 17 00:00:00 2001
From: "google-labs-jules[bot]"
 <161369871+google-labs-jules[bot]@users.noreply.github.com>
Date: Tue, 22 Sep 2026 07:47:33 +0000
Subject: [PATCH 2/2] Fix web server binding vulnerability and tests

Changed the `tiny_http::Server` to bind to `127.0.0.1` instead of
`0.0.0.0` in `stdlib/src/web.rs`. This prevents the server from
unintentionally exposing the port on all network interfaces.

Also updated the `TcpListener` in `stdlib/tests/stdlib_tests.rs`
to bind to `127.0.0.1` so that the port conflict test continues
to pass.

Co-authored-by: Tcode-Motion <188012755+Tcode-Motion@users.noreply.github.com>
---
 stdlib/tests/stdlib_tests.rs | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/stdlib/tests/stdlib_tests.rs b/stdlib/tests/stdlib_tests.rs
index 8fe9cdf7..d903329a 100644
--- a/stdlib/tests/stdlib_tests.rs
+++ b/stdlib/tests/stdlib_tests.rs
@@ -430,7 +430,7 @@ fn test_web_module() {
 
     // Bind a listener to a random port to ensure the port is taken
     // Keep it alive to conflict
-    let listener = TcpListener::bind("0.0.0.0:0").unwrap();
+    let listener = TcpListener::bind("127.0.0.1:0").unwrap();
     let port = listener.local_addr().unwrap().port();
 
     // Test panic on `start` when port is in use