mosaicstack/stack
25
0
Fork 1
Code Issues 340 Pull Requests 13 Actions Packages Projects Releases 15 Wiki Activity

fix(board): refuse foreign Host and Origin on every control-board route (#1507)

Browse Source 
After a DNS rebind, a web page could read /api/board and POST /api/reply,
which pastes into a live seat pane. foreignRequest() now runs first and
returns 403 for a non-loopback Host, a wrong port, userinfo or a path in
Host, or any Origin other than http://<Host>. A missing Origin still passes,
which covers the WebUI proxy. Dewey authored it; Rocko approved de9ff942
(review 5a12f08e) with one low wording finding, now fixed in the notes.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
This commit is contained in:
jason.woltje
2026-09-26 15:40:34 -05:00
co-authored by Claude Opus 5.5
parent 401cc850bb
commit d1629d610d
8 changed files with 461 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/SESSIONS.md
+3
View File
@@ -387,3 +387,6 @@ are never rewritten or removed; corrections are new entries.
2026-09-26T20:23:09Z | Filbert (T3 Claude Code, thread 9cb9731e) | #1508 queue-as-data plan round 4; CHAT-02 brief R2 review | Plan section 8 answers Rocko r3 T1-T8 with an 8.17 map, re-pinned 14dccfd0 (base 124b6f9e); Sage confirmed the 8.15 choices and sent it to Rocko round 4. CHAT-02 BRIEF.md ed177bf6: revise (agents/filbert/work/chat-02-brief-r2-review-2026-09-26.md 0f0154b7): Console-leg overclaim, answer attribution by order, missing cursor/touched/in-place/registration/Host fixtures, return-flow tightening. No source edits, commit or push.
2026-09-26T20:27:43Z | Dewey (T3 Claude Code, thread 84fb346c) | Row 5 CHAT-02 brief review cycle | Filbert R2 revise, R3 approve (3b81a3f2), R4 nits confirmed: BRIEF.md 636b0fac approved (review file fcd54625). Replay evidence pinned in agents/dewey/work/chat-02/evidence/replay-0913. Board Host/Origin gap on existing routes and D2 post-B1 owner raised to Sage. Build gated on Jason's go. No source edits, commit or push.
2026-09-26T20:31:58Z | Filbert (T3 Claude Code, thread 9cb9731e) | #1508 queue-as-data plan round 5; CHAT-02 brief R3/R4 review | Plan section 8 answers Rocko r4 (fcb8933d) F1-F5 with an 8.18 map, re-pinned 7d61f18d: pre-commit queue guard plus shared-index reconcile (F1, checked in a scratch repo on git 2.55), witness-first unlocked reads with a locked recheck (F2), genesis-first bootstrap with an isolated validator given its base (F3), Gate G freshness from the launch and linear files (F4), caller op ids capped at 72 characters (F5); Jason's per-seat token ruling folded into 8.9. CHAT-02 BRIEF.md R3 3b81a3f2 approved, R4 636b0fac confirmed (review file fcd54625, with a correction entry for my R2 count). No source edits, commit or push.
- 2026-09-26T20:35:39Z · Dewey (T3, claude-opus-5-5) · #1507 board Host/Origin guard before CHAT-02: serve.mjs foreignRequest + 2 failing-first tests, 7 scratch variants, suites 149/149 · candidate ready for Rocko's review via Sage; uncommitted
2026-09-26T20:35:44Z | Dewey (T3 Claude Code, thread 84fb346c) | #1507 board Host/Origin guard before CHAT-02 | Correction: the entry above at 20:35:39Z used the wrong line format; this one restates it. packages/control-board serve.mjs foreignRequest (d0a9bbed) plus two failing-first tests in serve.test.mjs (e01d7bd9); HEAD fails at foreign Host, six mutations each fail, control-board/webui/seat suites 149/149. Packet agents/dewey/work/board-guard/NOTES.md for Rocko via Sage. No commit or push.
2026-09-26T20:38:14Z | Sage (T3 Claude Code, thread 1ef1e4f8) | Integration: board Host/Origin guard | Rocko approved de9ff942 (review 5a12f08e); Sage committed the guard with records after suites on an index export, pushed, and restarted the control board. Discord restart still held on 6b R2.
docs/plans/DEFERRED.md
+1 -6
View File
@@ -113,12 +113,6 @@ at every gate. Started 2026-09-12 during the control board MVP.
same path could run a board reply as a slash command. Belongs to CHAT-03I/B3.
No tools/tmux change until that piece. Found by Dewey in the CHAT-02 brief
evidence. (2026-09-26, #1507)
- **Control board checks the bind address but not Host or Origin.** After a
DNS rebind, a web page could read `/api/board` and POST `/api/reply`, which
pastes text into a live seat pane. The WebUI server already checks both.
Not tested against a browser, so the exposure is unproven. Dewey writes the
guard as its own small change before CHAT-02, and Rocko reviews it.
(2026-09-26, #1507, found by Dewey)
## Queue
@@ -130,3 +124,4 @@ Moved to `docs/plans/QUEUE.md` on 2026-09-13. This file holds only gaps.
- Relaunched seat shows the old last message (darkwing, Step 3 log, 2026-09-12): closed by #1512 relaunch activity, af4203ca. Filbert authored it; Darkwing and Dewey reviewed. The live board restart and Gate F remain separate.
- Sage launcher hook uncommitted (2026-09-12): closed by the agents/sage launch files commit, Dewey review R1 revise, R2 approve (`agents/dewey/work/sage-launch-review-2026-09-26.md`), launcher test now covers sage.
- Ledger counts T3 agent messages as human (2026-09-26, #1506): fixed in ef0020ad (Darkwing 6a, Filbert reviewed). `messageKind` now counts a T3 header as agent and the control-board sender as board. It changes no current count, because no source the ledger reads has a T3 header yet. That waits for the T3 thread source (Gate F).
- Control board checked the bind address but not Host or Origin (2026-09-26, #1507, found by Dewey): closed by the board guard commit. `foreignRequest` refuses a non-loopback Host, a wrong port, userinfo or a path in Host, and any foreign Origin on every route. Dewey authored it, and Rocko approved it (`agents/rocko/work/board-guard-review-2026-09-26.md`, 5a12f08e). Rocko's one low finding: URL normalization accepts a root slash, empty userinfo and an empty query in Host, so the notes' wording overstates what the raw-syntax check refuses. No bypass was found.