mosaicstack/stack
25
0
Fork 1
Code Issues 340 Pull Requests 13 Actions Packages Projects Releases 15 Wiki Activity

fix(board): refuse foreign Host and Origin on every control-board route (#1507)

Browse Source 
After a DNS rebind, a web page could read /api/board and POST /api/reply,
which pastes into a live seat pane. foreignRequest() now runs first and
returns 403 for a non-loopback Host, a wrong port, userinfo or a path in
Host, or any Origin other than http://<Host>. A missing Origin still passes,
which covers the WebUI proxy. Dewey authored it; Rocko approved de9ff942
(review 5a12f08e) with one low wording finding, now fixed in the notes.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
This commit is contained in:
jason.woltje
2026-09-26 15:40:34 -05:00
co-authored by Claude Opus 5.5
parent 401cc850bb
commit d1629d610d
8 changed files with 461 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/SESSIONS.md
+3
View File
@@ -387,3 +387,6 @@ are never rewritten or removed; corrections are new entries.
2026-09-26T20:23:09Z | Filbert (T3 Claude Code, thread 9cb9731e) | #1508 queue-as-data plan round 4; CHAT-02 brief R2 review | Plan section 8 answers Rocko r3 T1-T8 with an 8.17 map, re-pinned 14dccfd0 (base 124b6f9e); Sage confirmed the 8.15 choices and sent it to Rocko round 4. CHAT-02 BRIEF.md ed177bf6: revise (agents/filbert/work/chat-02-brief-r2-review-2026-09-26.md 0f0154b7): Console-leg overclaim, answer attribution by order, missing cursor/touched/in-place/registration/Host fixtures, return-flow tightening. No source edits, commit or push.
2026-09-26T20:27:43Z | Dewey (T3 Claude Code, thread 84fb346c) | Row 5 CHAT-02 brief review cycle | Filbert R2 revise, R3 approve (3b81a3f2), R4 nits confirmed: BRIEF.md 636b0fac approved (review file fcd54625). Replay evidence pinned in agents/dewey/work/chat-02/evidence/replay-0913. Board Host/Origin gap on existing routes and D2 post-B1 owner raised to Sage. Build gated on Jason's go. No source edits, commit or push.
2026-09-26T20:31:58Z | Filbert (T3 Claude Code, thread 9cb9731e) | #1508 queue-as-data plan round 5; CHAT-02 brief R3/R4 review | Plan section 8 answers Rocko r4 (fcb8933d) F1-F5 with an 8.18 map, re-pinned 7d61f18d: pre-commit queue guard plus shared-index reconcile (F1, checked in a scratch repo on git 2.55), witness-first unlocked reads with a locked recheck (F2), genesis-first bootstrap with an isolated validator given its base (F3), Gate G freshness from the launch and linear files (F4), caller op ids capped at 72 characters (F5); Jason's per-seat token ruling folded into 8.9. CHAT-02 BRIEF.md R3 3b81a3f2 approved, R4 636b0fac confirmed (review file fcd54625, with a correction entry for my R2 count). No source edits, commit or push.
- 2026-09-26T20:35:39Z · Dewey (T3, claude-opus-5-5) · #1507 board Host/Origin guard before CHAT-02: serve.mjs foreignRequest + 2 failing-first tests, 7 scratch variants, suites 149/149 · candidate ready for Rocko's review via Sage; uncommitted
2026-09-26T20:35:44Z | Dewey (T3 Claude Code, thread 84fb346c) | #1507 board Host/Origin guard before CHAT-02 | Correction: the entry above at 20:35:39Z used the wrong line format; this one restates it. packages/control-board serve.mjs foreignRequest (d0a9bbed) plus two failing-first tests in serve.test.mjs (e01d7bd9); HEAD fails at foreign Host, six mutations each fail, control-board/webui/seat suites 149/149. Packet agents/dewey/work/board-guard/NOTES.md for Rocko via Sage. No commit or push.
2026-09-26T20:38:14Z | Sage (T3 Claude Code, thread 1ef1e4f8) | Integration: board Host/Origin guard | Rocko approved de9ff942 (review 5a12f08e); Sage committed the guard with records after suites on an index export, pushed, and restarted the control board. Discord restart still held on 6b R2.