fix(clearfolio): fail closed on provider redirects and unreviewed hosts - #536
fix(clearfolio): fail closed on provider redirects and unreviewed hosts#536cursor[bot] wants to merge 22 commits into
Conversation
Stop following Clearfolio 3xx responses so tenant HMAC headers cannot be replayed onto another origin. Reject token-free cross-origin, protocol- relative, credentialed, and fragmented artifact links instead of issuing an unreviewed attachment-view 302. Trim secret-file whitespace before HMAC signing and prove remote HTTP stays rejected in development. Co-authored-by: Seongho Bae <seonghobae@users.noreply.github.com>
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Do not land beside the origin-policy stack
This draft targets develop and overlaps Clearfolio redirect/host trust that #498 + #538 already own on the stacked parent fix/clearfolio-provider-response-boundary.
The current artifact-origin landing vehicle is #538 0c193aa28e730e5c1a18e7d740637f34efbbd95d. Landing this unstacked develop child would fork the adapter contract and skip the provider-response parent.
Do not merge. Do not treat this as a substitute for #538. If #493-shaped transport work is still needed, rebase it onto the live parent after #498 rather than widening develop in parallel.
Sent by Cursor Automation: Fix Issues
|
Closing as superseded after fresh comparison with the current Clearfolio stack. #498 owns the stronger bounded provider transport/redirect boundary, and #538 owns the reviewed artifact-origin policy on top of that parent. This draft forks from #493/develop and would duplicate those production surfaces rather than extend the canonical stack. The one extra |
2 participants
Buyer and security impact
Successor of #493 (
d122ca75). Keep that head unmerged. This branch retains the production fail-closed Clearfolio contract and closes two buyer-visible holes that #493 still left open:fetchnow usesredirect: 'error', so a 3xx from the pinned origin cannot replay tenant HMAC headers onto another host.HMAC secrets also trim surrounding whitespace (including a secret-file newline) before length-check and signing.
Exact current scope
develop@28420da358f57be5e85be3660251e39b85e1cc945c2f73dVerification
Local
npm run test:unitandnpm run test:apipassed on this head, including the new redirect, remote-HTTP-in-dev, HMAC-newline, and unreviewed-host cases.docs/doctoring/clearfolio-production-configuration.mdrecords the redirect and same-origin rules, rollback, remaining #489 gaps (reviewed artifact-host allowlist, streaming body/media-type limits, request budget), and APA 7 references to the WHATWG URL Standard, OWASP SSRF Prevention guidance, and NIST SSDF 1.1.Do not self-approve. Do not merge #493. Re-evaluate this unchanged head against live required checks before integration.