fix(security): restack inherited outbound body guard on protected main

[seonghobae]

Purpose

Restack only the reviewed credential-egress inherited-request-body correction from #299 onto the current protected-main lineage after #298 advanced main. The predecessor branch remains untouched.

Exact construction identity

• protected main immediately before construction: 10f7874f309cb120bc57b8c0cb637d1292650fe0;
• source predecessor fix(security): restack inherited outbound body guard on latest main #299 exact unchanged head: 6a8ddf172b4bbf0b7d620a4b9269ee9fe24f792e;
• successor exact head: 9926d155f3a02ffd9f194f125715693b7d49a7d9;
• successor tree: 01f826c943773c14b3600884b8f2737b5893dac3;
• ancestry: exactly one commit on current protected main, 1 ahead / 0 behind, merge base exactly 10f7874f309cb120bc57b8c0cb637d1292650fe0;
• scope: exactly three paths: src/outbound-fetch-policy.ts, new test/outbound-request-body-inheritance.test.ts, and test/outbound-request-compartment.test.ts.

The two pre-existing current-main path blobs are byte-identical to #299's protected base before this delta (src/outbound-fetch-policy.ts remained 10f41fad67826f022c5599b5b83679366ff96a10 across the #298 integration). The successor reuses #299's exact GREEN blobs e9c20e05cbc8e61103fc06a4c787fdb9360bbbd3, b4d422710b3ac81d59ca198265c36d672a84cc20, and b0023769c548b0f304f68e90b0b3bc08b1939f87; all unrelated bytes come from current protected main.

Security behavior

A body-bearing source Request combined with RequestInit.body: null or explicit undefined must not be treated as proof that the effective Fetch request has no body. The credential-egress policy therefore regards only non-null/non-undefined RequestInit.body as an explicit body and otherwise falls back to the source Request.body. Focused regressions require the body-bearing OIDC metadata cases to fail with blocked-request-policy before the raw network function runs. No destination or method allowlist is broadened.

Evidence boundary

#299's successful application CI, reviewer-ci and central Security Scan are predecessor evidence only and do not transfer. Keep this successor Draft until this unchanged exact head has fresh terminal-success application ci, reviewer-ci, protected-base-eligible central Security Scan, exact 100% owned production statement/branch/function/line coverage with realistic tests, and zero valid unresolved findings. Pending, queued, skipped, absent, neutral, failed, cancelled, stale, predecessor, status-only, model-only, or rate-limited evidence is non-passing.

Immediately before Ready or merge, independently re-resolve protected main, exact head/ref/ancestry, workflow checkout SHAs, live rulesets, central .github Security Scan revision/triggers/base filters/thresholds, formal reviews, unresolved threads and active-writer state. Live ruleset 18794436 currently enforces only central .github/workflows/security-scan.yml@refs/heads/main, with no bypass actor and no independent formal-approval rule; do not synthesize approval authority.

This change does not weaken gates, create repair/self-modifying workflows, publish/deploy, invent secrets/reviewers/evidence, or choose an outbound license.

Supersedes #299 only after fresh exact-head verification and protected integration.

Summary by CodeRabbit

• 버그 수정

  • RequestInit.body가 null 또는 undefined로 지정된 경우에도 원본 요청의 민감한 본문이 잘못 상속되지 않도록 요청 본문 처리를 개선했습니다.
  • 민감한 본문이 포함된 차단 대상 요청은 실제 네트워크 요청을 보내지 않고 정책에 따라 차단됩니다.
  • 차단 시 502 응답과 정책 차단을 나타내는 응답 헤더가 일관되게 반환됩니다.

• 테스트

  • 요청 본문 상속 및 차단 동작에 대한 검증을 강화했습니다.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 66110f4f-fafe-4c13-a888-6bfc1f4d97ab

📥 Commits

Reviewing files that changed from the base of the PR and between 10f7874 and 9926d15.

📒 Files selected for processing (3)

• src/outbound-fetch-policy.ts
• test/outbound-request-body-inheritance.test.ts
• test/outbound-request-compartment.test.ts

---

📝 Walkthrough

Walkthrough

outboundBodyPresent 조건을 여러 줄로 재구성했습니다. null 또는 undefined인 RequestInit.body가 원본 요청 본문을 제거하지 않는 동작을 테스트로 검증하고, 해당 요청을 차단하도록 기대값을 갱신했습니다.

Changes

아웃바운드 요청 본문 상속

Layer / File(s)	Summary
본문 존재 판정 및 상속 차단 검증 src/outbound-fetch-policy.ts, test/outbound-request-body-inheritance.test.ts, test/outbound-request-compartment.test.ts	outboundBodyPresent 조건을 여러 줄로 재구성했습니다. body가 null 또는 undefined이면 원본 Request 본문이 상속되는 동작을 검증합니다. 상속된 민감한 본문은 502 응답과 x-noema-egress-policy: blocked-request-policy 헤더를 반환하고 원본 fetch를 호출하지 않습니다.

Estimated code review effort: 2 (Simple) | ~10분

Merge Risk: ⚪ Minimal · up to 9926d

This localized change tightens inherited outbound-body blocking and adds focused regressions without broadening allowlists; no actionable merge-blocking risk remains at the current head beyond normal checks and review.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	제목은 상속된 outbound 본문 보안 검사를 protected main에 재적용하는 주요 변경을 정확하고 간결하게 설명합니다.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/outbound-request-body-inheritance-10f787

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}