mirror of
https://github.com/open-jarvis/OpenJarvis.git
synced 2026-07-28 05:12:26 +00:00
d7053c35d5
* security: harden network-exposed surface Hardening for the network-reachable attack surface, prioritizing fixes that are strong but do not change working local/loopback defaults. - auth_middleware: constant-time API key comparison (secrets.compare_digest) for the HTTP path, and gate /metrics behind auth so operational counters are not readable unauthenticated. /health stays open. - webhook_routes: fail closed when a channel's secret/token is unset. Twilio, BlueBubbles, WhatsApp (verify + inbound), and SendBlue now reject (403) instead of processing unsigned/unauthenticated input. Constant-time comparisons for BlueBubbles/SendBlue/WhatsApp verify token. - http_request: follow redirects manually and re-run the SSRF check on every hop (capped at 5) so an allowed public URL cannot 30x-redirect to an internal/metadata address. - api_routes /v1/memory/index: restrict indexing to OPENJARVIS_WORKSPACE roots when configured and refuse sensitive files (.env, keys, credentials). - config.toml: default [server] host to 127.0.0.1 (loopback) with a comment on how to safely expose to a LAN (0.0.0.0 + API key). Tests: new fail-closed webhook tests, /metrics auth tests, and SSRF redirect block/follow tests; updated SendBlue tests for the new secret-required behavior. Affected suites pass (95 tests), ruff clean. * fix(http): keep SSRF redirect-following patchable via httpx.request The manual redirect-following loop used a private httpx.Client, which bypassed the `http_request.httpx.request` mock seam that consumers' tests rely on (e.g. the twitter-bot GitHub-issue tests escaped to the real network and 401'd). Issue each hop via module-level httpx.request with follow_redirects=False instead — same per-hop SSRF re-check, restored testability. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Jon Saad-Falcon <jonsaadfalcon@gmail.com> Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>