Repository navigation
[P2][security] Credential host allowlist is config-author-controlled: add an operator-controlled allowlist (follow-up to #2086/#1977) #2103
Description
Follow-up to #2086 / #1977, found while auditing the #2086 fix (epic epic/security-zero-2026-10-19, local branch, not pushed yet).
Finding
The credential-host gate introduced by #1977 (REST) and extended by #2086 (all non-REST targets and findings_sink) has two parts:
- Env-name prefix (
DATA_BOAR_,REST_API_,API_): limits which process env vars a config can copy into a credential. This one has teeth against a config author. - Explicit destination allowlist (
allowed_hosts): read from the same YAML the config author writes. An author who can setpass_from_envandhostcan also setallowed_hosts: [<their host>], so this part is a speed bump, not an independent control.
Net effect: anyone who can write the scan YAML (partner snippet, config_admin, dashboard with require_api_key: false) can still send any env var that carries an allowed prefix (for example DATA_BOAR_* or API_* secrets) to a host they control, by listing that host in allowed_hosts.
Suggested direction (recommendation, not a decision)
- Add an operator-controlled allowlist that the config author cannot edit: for example a process env var (
DATA_BOAR_CREDENTIAL_ALLOWED_HOSTS) or a separate trusted file outside the scanned/edited YAML. A destination is accepted only if it is in the operator list; the in-configallowed_hostscan only narrow it, never widen it. - Fail closed when the operator list is unset and a target uses any
*_from_envcredential (with a documented migration path and an explicit opt-out for lab setups). - Keep REST (security(MEDIUM): REST connector base_url/token_url has no host allowlist — Bearer/client_secret exfil to public host #1977) and non-REST ([P1][security] pass_from_env copies any process env var into non-REST connector credentials (REST-only allowlist from #1977) #2086) on the same helper in
config/loader.py. - Regression tests: a config-supplied
allowed_hoststhat is not in the operator list is rejected for every target type and forfindings_sink. - Document the trust model (prefix gate vs host allowlist) in the security docs, en and pt-BR.
Related: #1977, #2086, #2087, #2098. Source: Claude audit of the #2086 fix, 2026-10-19.
Activity
FabioLeitao commentedon Oct 21, 2026
Audit comment after #2115 (merged 2026-10-21 02:15 UTC,
6bdb4ad). Read-only review ofmain; nothing was run against a live instance.#2115 deliberately leaves this issue open because
allowed_hostsis a brake on the same YAML. Agreed on that point.Class of problem (details withheld until the fix is merged). The env-name prefix rule (
CREDENTIAL_ENV_PREFIXESinconfig/loader.py) is documented indocs/SECURITY.mdas the control that is independent of the config author. The prefix namespace is shared with names that Boar itself reads from the environment, so the prefix alone does not separate operator-supplied credentials from Boar-internal values. Specific names and the reachable path are intentionally not listed in this public thread.Smallest change that restores the independence the docs claim (executor's choice): make the separation explicit (an explicit deny-list of Boar-internal names, or a distinct prefix for operator credentials), plus a test generated from a source scan of the names Boar reads from the environment, so the list cannot drift.
Docs drift in the same area.
docs/TECH_GUIDE.md:396anddocs/SECURITY.md:37disagree on whether non-REST*_from_envnames are subject to the prefix rule; one of them is stale.Provenance: git
6bdb4ad, read only. Triage before fix.fix(security): refuse reserved names inside credential placeholders
fix(security): treat non-string api keys as unclassified
FabioLeitao commentedon Oct 21, 2026
Nota de desenho, em classe. A lista do operador fica fora do YAML. A lista escrita no YAML só estreita; não amplia. O mesmo helper em
config/loader.pycobre REST, não-REST efindings_sink.Antes de codar: quando a lista do operador não está definida, instalações que já usam credencial via ambiente continuam como hoje, ou passam a falhar fechado com um opt-out documentado? Essa escolha muda o padrão das instalações existentes. Não implemento até a resposta.
FabioLeitao commentedon Oct 21, 2026
Nota de desenho, em classe. A lista do operador fica fora do YAML. A lista escrita no YAML só estreita; não amplia. O mesmo helper em
config/loader.pycobre REST, não-REST efindings_sink.Antes de codar: quando a lista do operador não está definida, instalações que já usam credencial via ambiente continuam como hoje, ou passam a falhar fechado com um opt-out documentado? Essa escolha muda o padrão das instalações existentes. Não implemento até a resposta.
fix(config): gate discover_url on the operator host list