Skip to content

security.md

Latest commit

 

History

History
123 lines (105 loc) · 7.05 KB

security.md

File metadata and controls

123 lines (105 loc) · 7.05 KB
Raw

Security model

Local trust boundary

Workbench assumes the host machine and people with access to its local browser session are trusted. It does not provide application accounts. Do not expose the app or PostgreSQL port directly to an untrusted network. Use a reverse proxy with transport security and access control if remote access is required.

Required controls

  • Permit only HTTP and HTTPS outbound protocols.
  • Resolve DNS and validate all address results before connection.
  • Block loopback, link-local, cloud metadata, and configured private destinations by default; validate each redirect independently.
  • Limit request bodies, response bodies, redirects, decompression, parser depth, archive expansion, and execution time.
  • Reject CR/LF header injection and unsafe file paths.
  • Parse YAML with safe schema and alias limits.
  • Render untrusted HTML only in a tightly sandboxed frame without same-origin or navigation privileges.
  • Redact authorization headers, API keys, passwords, access and refresh tokens, cookies, and marked secret variables before logs or persistence.
  • Exclude secrets from exports by default. Password-protected secret export uses authenticated encryption with a memory-hard password derivation function.

Disabling TLS verification or enabling access to private destinations is a per-request or explicit administrator choice and must be visible in the execution trace.

Outbound request implementation

The executor validates the protocol, rejects URL-embedded credentials, resolves every address, blocks mixed public/private DNS answers by default, and pins the socket to a validated address while retaining the original host for HTTP Host and TLS SNI. Redirect locations receive the same validation. Metadata hosts and addresses remain blocked even when a user explicitly enables trusted private-network access.

Request and response limits are enforced while streaming. Managed framing and hop-by-hop headers cannot be overridden. Saved execution snapshots redact marked and well-known sensitive headers, cookies, and sensitive query values; matching secrets are also removed from textual response previews. Cookie values and Set-Cookie headers are never persisted in clear text in execution history. The execution engine does not write request plans, bodies, or response contents to application logs.

OpenAPI URL imports use the same pinned-address policy and redirect validation as request execution. They add a 2 MiB source cap, a 15-second timeout, five-redirect limit, and bounded parsing. URL credentials, non-HTTP protocols, cloud metadata targets, and unsafe redirects remain blocked even when trusted local networking is enabled. Posted preview content is not trusted as a way to bypass validation of its declared source URL.

Portable collection imports accept at most 2 MiB and bound JSON depth, node count, request count, field count, variables, configuration records, URL length, and body size. Prototype-related JSON keys are rejected. cURL and HTTPie CLI input is parsed by a non-executing tokenizer: shell pipes, redirects, command substitution, multiple commands, and cURL config files are rejected. Embedded file references are recorded as unsupported metadata and never read from the host filesystem. Imports are reparsed at execution and selected source keys must still match the approved preview.

Variable values are stored only in the local PostgreSQL installation so they can be reused. The local trust boundary therefore includes database access. Marked values are password-masked in the normal editor and never returned in resolution previews, execution snapshots, resolved display URLs, or textual response history. Secret taint propagates through nested interpolation, and temporary runtime overrides are never persisted as configuration. Exports omit secrets by default.

Authentication profiles follow the same local trust model. Secret profile fields are replaced with a fixed placeholder in browser DTOs, and saving that placeholder preserves the existing server-side value. Direct OAuth access and refresh tokens live only in the local database cache and server execution path. Saved-request token outputs are masked in output views and redacted from response metadata before persistence. Authentication traces contain profile identity, credential source, and injection target, but never the credential. Editing a profile or override invalidates its direct OAuth cache.

Azure Key Vault references keep resolved values outside PostgreSQL, archives, backups, execution history, and browser responses. The standard container runs a pinned Azure CLI as the same non-root application user and stores its token cache only in the mode-0700 workbench_azure_cli volume. UI login launches a fixed argument array with shell: false, permits one process at a time, bounds captured output and lifetime, and maps raw CLI failures to sanitized messages. The temporary device code is returned only during its active sign-in and is not logged or persisted.

Key Vault access tokens are requested server-side for https://vault.azure.net. To prevent bearer-token disclosure and SSRF, vault URLs must use HTTPS, contain no credentials, custom port, path, query, or fragment, and end in the exact public Azure suffix .vault.azure.net. Redirects are rejected. The REST response is schema-validated and the resolved value is added to the same in-memory secret-redaction set as a locally stored credential.

Assertion evaluation runs on the server after a bounded response has completed. Definitions and counts are schema-bounded. Regular expressions reject backreferences, lookarounds, nested quantifiers, repeated unbounded wildcards, and oversized patterns; JSON Schemas are bounded JSON objects compiled without external reference loading. Persisted results contain pass/fail messages, never the actual matched header, JSONPath, or body value. Workflow runtime overrides follow the existing secret-taint path, and run reports expose only masked output values through their linked execution DTOs.

Export archives accept only four generated top-level filenames and enforce compressed, per-file, and expanded size limits before parsing JSON. The manifest binds each payload with SHA-256 and record counts. Unknown columns are discarded; foreign-key or folder-cycle failures roll back the transaction. Default exports remove known credential fields plus potentially sensitive import sources, request snapshots, response previews, and stored errors. Encrypted secret payloads use scrypt and AES-256-GCM. Plain-text mode is opt-in and visibly warned. Backup paths are generated and contained beneath the configured directory; symlinks are not restored, files use 0600, and retention deletes only names matching the generated backup pattern.

Dependencies and images

CI fails for high-severity npm audit findings. Dependabot monitors npm, Docker, and GitHub Actions dependencies. Production containers run as a non-root user and contain the standalone application, runtime dependencies, migrations, Azure CLI, and public assets. Azure CLI is pinned and the image continues to be built and tested for linux/amd64 and linux/arm64.