mirror of
https://github.com/outbackdingo/optimclaw.git
synced 2026-09-01 09:09:19 +00:00
fix: security hardening across all layers (#35)
* fix: comprehensive security hardening across all layers Critical: - Replace --dangerously-skip-permissions with explicit tool allowlist via settings.json (Claude Code bridge) - Constant-time token comparison (subtle crate) in web auth and orchestrator auth to prevent timing attacks High: - Revoke tokens and clean up handles on container creation failure - Drop SETUID/SETGID capabilities from containers (keep only CHOWN) - Disable redirect following in HTTP tool and WASM wrapper (SSRF) - Reject URL userinfo (@) in WASM allowlist parser (host confusion) - Fix binary body bypassing leak detection (from_utf8 -> from_utf8_lossy) - Protect identity files from LLM overwrites (prompt injection defense) - Prevent tool shadowing: built-in tools cannot be replaced dynamically - User-scoped job APIs: list/detail/cancel/restart/prompt/events/files - CORS restricted to localhost origins, WebSocket origin validation - Sandbox shell fail-closed: no silent fallback to unsandboxed execution - Scrub secrets from log broadcaster before SSE broadcast - XSS sanitization on rendered markdown in web UI - WASM epoch ticker thread so timeout deadlines actually fire Medium: - Cap state transition history at 200 entries - SSE/WebSocket connection limit (100 max) - Request body size limit (1MB) - Response body size limit enforcement in WASM HTTP - UTF-8 safe string truncation (routine engine, shell tool) - Fix PolicyAction::Sanitize to actually run the sanitizer - TOCTOU fix in scheduler and context manager (hold write lock) - Project file serving moved behind auth - Path traversal guard on project_id - Session file permissions set to 0600 on unix - AtomicUsize for routine running_count (panic-safe) - Completion detection hardened against false positives and tool injection - Tool output no longer drives job completion (only LLM response) Co-Authored-By: Claude Opus 4.6 <[email protected]> * fix: address security review findings across all layers - Fix path traversal sandbox bypass via lexical normalization (file.rs) - Fix SSRF via DNS rebinding with pre-request hostname resolution (http.rs) - Add token budget enforcement on LLM calls (reasoning.rs, state.rs) - Fix cross-user chat history leak with ownership verification (store.rs, server.rs) - Add sliding-window rate limiter on gateway chat endpoint (server.rs) - Harden extension install: HTTPS-only, 50MB cap, WASM magic validation (manager.rs) - Add destructive command blocklist that overrides shell auto-approval (shell.rs) - Add 5MB response body size cap to HTTP tool (http.rs) Co-Authored-By: Claude Opus 4.6 <[email protected]> * refactor: deduplicate shared helpers and remove dead code Extract floor_char_boundary and llm_signals_completion into src/util.rs, unifying diverging phrase lists from agent/worker.rs and worker/runtime.rs. Remove dead RespondResult::usage(), duplicate PROTECTED_IDENTITY_FILES constant, double LeakDetector scanning in WebLogLayer, and invalid 0.0.0.0 origin from WebSocket allow list. Co-Authored-By: Claude Opus 4.6 <[email protected]> * fix: address PR review findings and CI test failures - Fix record_failed_approve: .truncate(true) wiped the attempts file before reading, so failed pairing attempts never accumulated and rate limiting never triggered. - Guard wizard WASM test: skip gracefully when channel build artifacts are absent (CI doesn't compile wasm32-wasip2 targets). - Fix DNS rebinding check: use port 0 instead of hardcoded 443, since the port is irrelevant for hostname resolution. - Remove hardcoded CORS port 3001: the dynamic addr.port() entries already cover the actual server port. - Require WebSocket Origin header: reject connections that omit it entirely, since browsers always send Origin for WS upgrades and a missing header indicates a non-browser client bypassing the check. Co-Authored-By: Claude Opus 4.6 <[email protected]> * fix: address second round of PR review findings - store.rs: reintroduce file locking around read-modify-write in record_failed_approve (concurrent callers could clobber each other). - sse.rs: replace load+check+fetch_add with atomic fetch_update in both subscribe_raw() and subscribe() to prevent overshooting max_connections. - ws.rs: decrement WS tracker before early return when subscribe_raw() returns None (connection limit reached), fixing a counter leak. - server.rs: parse WS Origin host exactly instead of prefix matching, preventing bypass via crafted origins like http://localhost.evil.com. - workspace_integration.rs: skip tests gracefully when Postgres is unreachable instead of panicking (fixes 10 CI failures). Co-Authored-By: Claude Opus 4.6 <[email protected]> * fix: add Origin header to WS integration tests The Origin header requirement added in a3b0190 broke the WS gateway integration tests. Test clients now send Origin: http://127.0.0.1:{port} to match the server's localhost validation. Co-Authored-By: Claude Opus 4.6 <[email protected]> --------- Co-authored-by: Claude Opus 4.6 <[email protected]>
This commit is contained in:
Illia Polosukhin
co-authored by
Claude Opus 4.6
Claude Opus 4.6
parent
e0a43c81f9
commit
33ef0a6ea5
@@ -14,6 +14,7 @@ use axum::http::StatusCode;
|
||||
use axum::middleware::Next;
|
||||
use axum::response::Response;
|
||||
use rand::Rng;
|
||||
use subtle::ConstantTimeEq;
|
||||
use tokio::sync::RwLock;
|
||||
use uuid::Uuid;
|
||||
|
||||
@@ -38,13 +39,13 @@ impl TokenStore {
|
||||
token
|
||||
}
|
||||
|
||||
/// Validate a token for a specific job.
|
||||
/// Validate a token for a specific job (constant-time comparison).
|
||||
pub async fn validate(&self, job_id: Uuid, token: &str) -> bool {
|
||||
self.tokens
|
||||
.read()
|
||||
.await
|
||||
.get(&job_id)
|
||||
.map(|stored| stored == token)
|
||||
.map(|stored| stored.as_bytes().ct_eq(token.as_bytes()).into())
|
||||
.unwrap_or(false)
|
||||
}
|
||||
|
||||
|
||||
@@ -58,6 +58,8 @@ pub struct ContainerJobConfig {
|
||||
pub claude_code_max_turns: u32,
|
||||
/// Memory limit in MB for Claude Code containers (heavier than workers).
|
||||
pub claude_code_memory_limit_mb: u64,
|
||||
/// Allowed tool patterns for Claude Code (passed as CLAUDE_CODE_ALLOWED_TOOLS env var).
|
||||
pub claude_code_allowed_tools: Vec<String>,
|
||||
}
|
||||
|
||||
impl Default for ContainerJobConfig {
|
||||
@@ -71,6 +73,7 @@ impl Default for ContainerJobConfig {
|
||||
claude_code_model: "sonnet".to_string(),
|
||||
claude_code_max_turns: 50,
|
||||
claude_code_memory_limit_mb: 4096,
|
||||
claude_code_allowed_tools: crate::config::ClaudeCodeConfig::default().allowed_tools,
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -161,6 +164,29 @@ impl ContainerJobManager {
|
||||
};
|
||||
self.containers.write().await.insert(job_id, handle);
|
||||
|
||||
// Run the actual container creation. On any failure, revoke the token
|
||||
// and remove the handle so we don't leak resources.
|
||||
match self
|
||||
.create_job_inner(job_id, &token, project_dir, mode)
|
||||
.await
|
||||
{
|
||||
Ok(()) => Ok(token),
|
||||
Err(e) => {
|
||||
self.token_store.revoke(job_id).await;
|
||||
self.containers.write().await.remove(&job_id);
|
||||
Err(e)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
/// Inner implementation of container creation (separated for cleanup).
|
||||
async fn create_job_inner(
|
||||
&self,
|
||||
job_id: Uuid,
|
||||
token: &str,
|
||||
project_dir: Option<PathBuf>,
|
||||
mode: JobMode,
|
||||
) -> Result<(), OrchestratorError> {
|
||||
// Connect to Docker
|
||||
let docker = connect_docker()
|
||||
.await
|
||||
@@ -219,11 +245,18 @@ impl ContainerJobManager {
|
||||
env_vec.push("IRONCLAW_WORKSPACE=/workspace".to_string());
|
||||
}
|
||||
|
||||
// Claude Code mode: mount host ~/.claude read-only for auth
|
||||
// Claude Code mode: mount host ~/.claude read-only for auth,
|
||||
// and pass the tool allowlist so the bridge can write settings.json.
|
||||
if mode == JobMode::ClaudeCode {
|
||||
if let Some(ref claude_dir) = self.config.claude_config_dir {
|
||||
binds.push(format!("{}:/home/sandbox/.claude:ro", claude_dir.display()));
|
||||
}
|
||||
if !self.config.claude_code_allowed_tools.is_empty() {
|
||||
env_vec.push(format!(
|
||||
"CLAUDE_CODE_ALLOWED_TOOLS={}",
|
||||
self.config.claude_code_allowed_tools.join(",")
|
||||
));
|
||||
}
|
||||
}
|
||||
|
||||
// Memory limit: Claude Code gets more memory
|
||||
@@ -243,11 +276,7 @@ impl ContainerJobManager {
|
||||
network_mode: Some("bridge".to_string()),
|
||||
extra_hosts: Some(vec!["host.docker.internal:host-gateway".to_string()]),
|
||||
cap_drop: Some(vec!["ALL".to_string()]),
|
||||
cap_add: Some(vec![
|
||||
"CHOWN".to_string(),
|
||||
"SETUID".to_string(),
|
||||
"SETGID".to_string(),
|
||||
]),
|
||||
cap_add: Some(vec!["CHOWN".to_string()]),
|
||||
security_opt: Some(vec!["no-new-privileges:true".to_string()]),
|
||||
tmpfs: Some(
|
||||
[("/tmp".to_string(), "size=512M".to_string())]
|
||||
@@ -328,7 +357,7 @@ impl ContainerJobManager {
|
||||
"Created and started worker container"
|
||||
);
|
||||
|
||||
Ok(token)
|
||||
Ok(())
|
||||
}
|
||||
|
||||
/// Stop a running container job.
|
||||
@@ -355,15 +384,18 @@ impl ContainerJobManager {
|
||||
})?;
|
||||
|
||||
// Stop the container (10 second grace period)
|
||||
let _ = docker
|
||||
if let Err(e) = docker
|
||||
.stop_container(
|
||||
&container_id,
|
||||
Some(bollard::container::StopContainerOptions { t: 10 }),
|
||||
)
|
||||
.await;
|
||||
.await
|
||||
{
|
||||
tracing::warn!(job_id = %job_id, error = %e, "Failed to stop container (may already be stopped)");
|
||||
}
|
||||
|
||||
// Remove the container
|
||||
let _ = docker
|
||||
if let Err(e) = docker
|
||||
.remove_container(
|
||||
&container_id,
|
||||
Some(bollard::container::RemoveContainerOptions {
|
||||
@@ -371,7 +403,10 @@ impl ContainerJobManager {
|
||||
..Default::default()
|
||||
}),
|
||||
)
|
||||
.await;
|
||||
.await
|
||||
{
|
||||
tracing::warn!(job_id = %job_id, error = %e, "Failed to remove container (may require manual cleanup)");
|
||||
}
|
||||
|
||||
// Update state
|
||||
if let Some(handle) = self.containers.write().await.get_mut(&job_id) {
|
||||
@@ -409,22 +444,33 @@ impl ContainerJobManager {
|
||||
};
|
||||
if let Some(cid) = container_id {
|
||||
if !cid.is_empty() {
|
||||
if let Ok(docker) = connect_docker().await {
|
||||
let _ = docker
|
||||
.stop_container(
|
||||
&cid,
|
||||
Some(bollard::container::StopContainerOptions { t: 5 }),
|
||||
)
|
||||
.await;
|
||||
let _ = docker
|
||||
.remove_container(
|
||||
&cid,
|
||||
Some(bollard::container::RemoveContainerOptions {
|
||||
force: true,
|
||||
..Default::default()
|
||||
}),
|
||||
)
|
||||
.await;
|
||||
match connect_docker().await {
|
||||
Ok(docker) => {
|
||||
if let Err(e) = docker
|
||||
.stop_container(
|
||||
&cid,
|
||||
Some(bollard::container::StopContainerOptions { t: 5 }),
|
||||
)
|
||||
.await
|
||||
{
|
||||
tracing::warn!(job_id = %job_id, error = %e, "Failed to stop completed container");
|
||||
}
|
||||
if let Err(e) = docker
|
||||
.remove_container(
|
||||
&cid,
|
||||
Some(bollard::container::RemoveContainerOptions {
|
||||
force: true,
|
||||
..Default::default()
|
||||
}),
|
||||
)
|
||||
.await
|
||||
{
|
||||
tracing::warn!(job_id = %job_id, error = %e, "Failed to remove completed container");
|
||||
}
|
||||
}
|
||||
Err(e) => {
|
||||
tracing::warn!(job_id = %job_id, error = %e, "Failed to connect to Docker for container cleanup");
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user