feat: plan 16 P2 batch 1 (SEC-13 SSRF, SEC-27 log-escape, SEC-28 path-traversal)
- SEC-13 (M-09): SSRF allowlist on provider-usage-fetch (always block non-http(s) schemes; enforced mode blocks internal/link-local IPs + non-allowlisted hosts, dev keeps loopback mocks); dashboard refuses non-loopback bind in enforced mode. - SEC-27 (X-02): casan-log strips ESC/CSI + CR/LF (terminal-escape + fake-log-line injection) while keeping tab and visible text. - SEC-28 (X-04): new path-guard.sh — realpath resolve + reject symlink/.. escapes outside the allowed root. Verify: SEC-13 6/0, SEC-27 3/0, SEC-28 4/0, adversarial 44/44, run-casan4 0-FAIL. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
thanhnv
co-authored by
Claude Opus 4.8
Claude Opus 4.8
parent
3432ae59e1
commit
8c06a55aed
@@ -24,8 +24,12 @@ casan_log() {
|
||||
local lvl="$1" comp="$2"
|
||||
shift 2
|
||||
[ "$(casan_log_num "$lvl")" -le "$CASAN_LOG_THRESHOLD" ] || return 0
|
||||
# SEC-27 (X-02): log messages carry attacker-influenced data (action names, tool
|
||||
# output snippets). Strip control chars — ESC/CSI (terminal-escape injection that
|
||||
# rewrites a reviewer's screen) and CR/LF (fake-log-line injection) — keeping tab.
|
||||
local msg; msg="$(printf '%s' "$*" | tr -d '\000-\010\012-\037\177')"
|
||||
printf '[%s] %s [%s] %s\n' \
|
||||
"$(printf '%s' "$lvl" | tr '[:lower:]' '[:upper:]')" \
|
||||
"$(date -u +"%Y-%m-%dT%H:%M:%SZ")" \
|
||||
"$comp" "$*" >&2
|
||||
"$comp" "$msg" >&2
|
||||
}
|
||||
|
||||
@@ -104,6 +104,10 @@ run "phase-sec20-toolchain" bash "$TESTS/phase-sec20-tests.sh"
|
||||
run "phase-sec21-model-budget" bash "$TESTS/phase-sec21-tests.sh"
|
||||
run "phase-sec07-approval" bash "$TESTS/phase-sec07-tests.sh"
|
||||
run "phase-sec10-agent-identity" bash "$TESTS/phase-sec10-tests.sh"
|
||||
# Plan-16 P2 (depth / hardening)
|
||||
run "phase-sec13-ssrf" bash "$TESTS/phase-sec13-tests.sh"
|
||||
run "phase-sec27-log-controlchar" bash "$TESTS/phase-sec27-tests.sh"
|
||||
run "phase-sec28-path-traversal" bash "$TESTS/phase-sec28-tests.sh"
|
||||
|
||||
# ARCH-02: coverage cannot silently drop; ARCH-01: harness/policy cannot silently
|
||||
# drift. Both SKIP cleanly when no manifest is provisioned (non-strict dev/CI).
|
||||
|
||||
@@ -77,4 +77,11 @@ BIND = os.environ.get("CASAN_DASHBOARD_BIND", "127.0.0.1")
|
||||
|
||||
|
||||
if __name__ == "__main__":
|
||||
# SEC-13 (M-09): the dashboard has no auth, so binding to all interfaces exposes
|
||||
# it to the network. In enforced mode refuse a non-loopback bind (fail-closed);
|
||||
# a real deployment must front it with TLS + auth (Plan-07 TIER 2), not 0.0.0.0.
|
||||
_enforced = os.environ.get("CASAN_PROFILE") == "prod" or os.environ.get("CASAN_DASHBOARD_STRICT") == "1"
|
||||
if _enforced and BIND not in ("127.0.0.1", "::1", "localhost"):
|
||||
sys.stderr.write(f"DASHBOARD_BIND_REFUSED bind={BIND} (loopback only in enforced mode)\n")
|
||||
raise SystemExit(1)
|
||||
HTTPServer((BIND, PORT), Handler).serve_forever()
|
||||
|
||||
@@ -0,0 +1,39 @@
|
||||
#!/usr/bin/env bash
|
||||
set -uo pipefail
|
||||
|
||||
# CASAN Plan-16 SEC-28 (X-04) — path-traversal / symlink guard.
|
||||
#
|
||||
# A tool that takes a file path as input/output can be pointed at an arbitrary
|
||||
# location via `..` or a symlink (e.g. a symlink named "input.txt" -> /etc/passwd),
|
||||
# reading or writing outside the workspace. This resolves the REAL path (following
|
||||
# every symlink) and refuses anything that escapes the allowed root.
|
||||
#
|
||||
# Usage: path-guard.sh <path> [allowed-root] (default root: repo workspace)
|
||||
# Exit: 0 inside the root, 1 outside / unresolvable.
|
||||
|
||||
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
||||
PROJECT_ROOT="$(cd "$SCRIPT_DIR/../../.." && pwd)"
|
||||
|
||||
TARGET="${1:-}"
|
||||
ROOT="${2:-$PROJECT_ROOT}"
|
||||
if [[ -z "$TARGET" ]]; then
|
||||
echo "Usage: path-guard.sh <path> [allowed-root]" >&2
|
||||
exit 64
|
||||
fi
|
||||
|
||||
python3 - "$TARGET" "$ROOT" <<'PY'
|
||||
import os
|
||||
import sys
|
||||
|
||||
target, root = sys.argv[1], sys.argv[2]
|
||||
# realpath resolves symlinks in every existing path component and normalizes "..";
|
||||
# for a not-yet-created leaf it resolves the existing parent chain.
|
||||
real_target = os.path.realpath(target)
|
||||
real_root = os.path.realpath(root)
|
||||
|
||||
if real_target == real_root or real_target.startswith(real_root + os.sep):
|
||||
print(f"PATH_OK {real_target}")
|
||||
sys.exit(0)
|
||||
sys.stderr.write(f"PATH_ESCAPES_ROOT target={target} real={real_target} root={real_root}\n")
|
||||
sys.exit(1)
|
||||
PY
|
||||
@@ -24,6 +24,52 @@ PROJECT_ROOT="$(cd "$SCRIPT_DIR/../../.." && pwd)"
|
||||
OUT="${2:-$PROJECT_ROOT/.specify/logs/level5/provider-usage.jsonl}"
|
||||
mkdir -p "$(dirname "$OUT")"
|
||||
|
||||
# SEC-13 (M-09): SSRF guard on the fetch URL. ALWAYS reject non-http(s) schemes
|
||||
# (file://, gopher://, dict://, … metadata exfil). In enforced mode additionally
|
||||
# require the host to be in the provider allowlist and block internal/link-local
|
||||
# IPs — dev keeps loopback mocks working (http://127.0.0.1 test servers).
|
||||
if ! python3 - "$API_URL" <<'PY'
|
||||
import ipaddress, os, sys
|
||||
from urllib.parse import urlparse
|
||||
|
||||
url = sys.argv[1]
|
||||
u = urlparse(url)
|
||||
scheme = (u.scheme or "").lower()
|
||||
host = (u.hostname or "").lower()
|
||||
enforced = os.environ.get("CASAN_PROFILE") == "prod" or os.environ.get("CASAN_SSRF_STRICT") == "1"
|
||||
allow = [h.strip().lower() for h in os.environ.get(
|
||||
"CASAN_PROVIDER_HOST_ALLOWLIST", "api.openai.com,api.anthropic.com").split(",") if h.strip()]
|
||||
|
||||
def die(reason):
|
||||
sys.stderr.write(f"PROVIDER_URL_REJECTED {reason} url={url}\n")
|
||||
sys.exit(1)
|
||||
|
||||
if scheme not in ("http", "https"):
|
||||
die(f"scheme_not_allowed:{scheme or 'none'}") # blocks file:// et al (all modes)
|
||||
if not host:
|
||||
die("no_host")
|
||||
|
||||
if enforced:
|
||||
if scheme != "https":
|
||||
die("plaintext_http_not_allowed_in_prod")
|
||||
if host in ("localhost",) or host.endswith(".internal") or host.endswith(".local"):
|
||||
die(f"internal_host:{host}")
|
||||
try:
|
||||
ip = ipaddress.ip_address(host)
|
||||
if (ip.is_private or ip.is_loopback or ip.is_link_local or ip.is_reserved
|
||||
or ip.is_multicast or ip.is_unspecified):
|
||||
die(f"internal_ip:{host}")
|
||||
except ValueError:
|
||||
pass # a hostname, not a literal IP
|
||||
if allow and host not in allow:
|
||||
die(f"host_not_in_allowlist:{host}")
|
||||
sys.exit(0)
|
||||
PY
|
||||
then
|
||||
echo "PROVIDER_API_SSRF_BLOCKED url=$API_URL (telemetry NOT imported)" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
BODY="$(mktemp)"
|
||||
trap 'rm -f "$BODY"' EXIT
|
||||
|
||||
|
||||
Reference in New Issue
Block a user