Boundaries that were supposed to hold

The security pass. Six findings, none reachable by visiting the site and
every one a boundary this codebase says it keeps.

A subagent is pinned to a list of read-only commands, in every mode,
unattended, with no card anybody could approve -- and `find *` was on it.
find writes files with -fprintf, runs programs with -exec and removes them
with -delete, and none of that needs a character the metacharacter guard
refuses. A page the model had just read could ask for a helper and get a
key into authorized_keys, from Plan mode, which promises to change
nothing. Refused in `subject()` rather than trimmed from the list: a
pattern cannot say "and no dangerous flags", and "this one looks
read-only" is exactly what put find there.

The loopback guard missed `0.0.0.0`, which is not is_loopback but does
connect to localhost -- so it answered a *decided* False and skipped the
DNS half too. The one spelling of "this machine" that walked past a guard
whose whole job is that sentence.

Twice in the update helper, which is the one place this deliberately
crosses a privilege boundary: root ran a script the service account owns,
and root sourced a file that account can replace. Either turns a
compromise of the web application into root. The first needed no
compromise at all -- a pull happens as the service user and root runs
whatever it fetched, so control of the branch was control of root. The
old test asserted that exact ExecStart line and had pinned it in place.

Push endpoints skipped check_url, the only outbound request that did. And
a chat could be filed in another account's folder, which hands over its
system prompt -- `_new_chat` resolved the folder, discarded it when it was
not the caller's, and stored the raw id anyway.

An existing helper install keeps the old wiring until install.sh is
re-run; update.sh now says so when it finds itself inside the checkout.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

src/lembas/__init__.py

@@ -1,3 +1,3 @@
 """LLeMbas - a Middle-earth themed web UI for OpenAI-compatible LLM endpoints."""
 
-__version__ = "0.9.11"
+__version__ = "0.9.12"

src/lembas/api/chats.py

@@ -213,7 +213,13 @@ def _new_chat(
     profile = _agent_target(db, user, kind, ssh_profile_id)
     chat = Chat(
         user_id=user.id,
-        folder_id=folder_id or None,
+        # `folder`, not `folder_id`: the raw value is what the request asked
+        # for, and the lines above already discarded it when it names somebody
+        # else's folder. Storing the raw one put the chat there anyway -- so the
+        # ownership check governed which *seeds* were applied and not where the
+        # chat actually went, and a folder's system prompt is read on every turn
+        # from wherever the chat sits.
+        folder_id=folder.id if folder is not None else None,
         model_id=chosen[0] if chosen else "",
         connection_id=chosen[1] if chosen else None,
         temporary=temporary,
@@ -1940,7 +1946,16 @@ async def update_chat(request: Request, db: Db, user: RequiredUser, chat_id: str
             renamed = True
 
     if "folder_id" in form:
-        chat.folder_id = str(form["folder_id"]) or None
+        # Resolved against *this person's* folders, not taken as given. A folder
+        # is not just a label: `effective_system_prompt` walks up from the chat
+        # through its folder and its parents, so a chat attached to somebody
+        # else's folder would take their system prompt -- reading a setting
+        # across an ownership boundary through a field that looks like a tag.
+        # Unknown or not theirs means no folder, which is the same answer
+        # `_new_chat` gives.
+        wanted = str(form["folder_id"]).strip()
+        folder = db.get(Folder, wanted) if wanted else None
+        chat.folder_id = folder.id if folder is not None and folder.user_id == user.id else None
 
     # The mode is the one agent field that changes mid-chat: it decides what
     # gets asked about, not what the conversation is.

src/lembas/api/push.py

@@ -17,7 +17,9 @@ from sqlalchemy import select
 
 from lembas.api.deps import Db, RequiredUser
 from lembas.db.models import PushSubscription
+from lembas.services import fetch as fetch_service
 from lembas.services import push as push_service
+from lembas.services.fetch import FetchError
 
 log = logging.getLogger(__name__)
 
@@ -61,6 +63,21 @@ async def subscribe(request: Request, db: Db, user: RequiredUser) -> Response:
     if not endpoint.startswith("https://") or not p256dh or not auth:
         return Response(status_code=status.HTTP_400_BAD_REQUEST)
 
+    # The endpoint is a URL the browser hands us and the server later POSTs to,
+    # which makes it the same shape as every other URL a request can name --
+    # and it was the one outbound client in the codebase not going through the
+    # SSRF guard. `https://` alone says nothing about *where*: an internal
+    # address is as valid a URL as Mozilla's push service, and the caller
+    # triggers delivery themselves by sending a message and closing the tab.
+    #
+    # Checked here **and** again before the POST, the split `agent/hosts.py`
+    # uses: a row can predate a DNS change, and this one is stored.
+    try:
+        fetch_service.check_url(endpoint)
+    except FetchError as exc:
+        log.warning("refused a push endpoint from %s: %s", user.email, exc.message)
+        return Response(status_code=status.HTTP_400_BAD_REQUEST)
+
     existing = db.scalars(
         select(PushSubscription).where(PushSubscription.endpoint == endpoint)
     ).first()

src/lembas/services/agent/hosts.py

@@ -107,9 +107,17 @@ def _literal(host: str) -> bool | None:
     if text in ("localhost", "localhost.localdomain", "ip6-localhost", "ip6-loopback"):
         return True
     try:
-        return ipaddress.ip_address(text).is_loopback
+        address = ipaddress.ip_address(text)
     except ValueError:
         return None
+    # `is_unspecified` as well as `is_loopback`, because `0.0.0.0` and `::` are
+    # neither a real destination nor a refused one: connect() to either goes to
+    # loopback on Linux, so an SSH profile pointed at `0.0.0.0` reached this
+    # host's own sshd. `is_loopback` alone answered a decided **False**, which
+    # also short-circuited `resolves_here`, so the DNS half never ran either --
+    # the one spelling of "this machine" that walked past a guard whose whole
+    # job is that sentence.
+    return address.is_loopback or address.is_unspecified
 
 
 def is_loopback(host: str) -> bool:

src/lembas/services/agent/policy.py

@@ -111,6 +111,37 @@ POLICY: dict[str, dict[str, str]] = {
 # confined to `decide` and is worth doing; it is not done here.
 _UNSAFE = re.compile(r"[;&|<>`$\n\\()]")
 
+# Flags that turn a "read-only" command into one that writes or executes, on
+# tools whose *name* is on somebody's allow list.
+#
+# `_UNSAFE` stops a command line being composed out of two commands. It does
+# nothing about a single command that composes one itself, and several of the
+# obvious read-only tools do: `find -exec cmd +` runs a program, `-fprintf`
+# writes a file, `-delete` removes one, and `rg --pre` runs a preprocessor for
+# every file it opens. None of those needs a character `_UNSAFE` refuses, so
+# `find *` on an allow list -- which is what a subagent gets, in every mode --
+# was arbitrary write and arbitrary execution wearing a read-only name.
+#
+# Refused here rather than trimmed from the allow list alone, because the list
+# is the thing an administrator edits and "this one looks read-only" is exactly
+# the reasoning that put `find *` there. A pattern cannot express "and no
+# dangerous flags"; this can.
+#
+# Matched on the *normalised* line and word-bounded, so `docs/-exec-notes.md`
+# is fine -- the flag has to stand alone as an argument.
+#
+# It does catch `grep -rn -- -delete src/`, where the word is a search term
+# rather than a flag, and that is the right direction to be wrong in: a false
+# refusal here means the call falls through to the policy table and asks, which
+# costs one approval card. A false allow means an unattended helper writing
+# files. Nothing is *blocked* by this -- a reader in Auto still gets it, and in
+# any other mode they are shown it first, which is what they would want to be
+# shown.
+_ACTION = re.compile(
+    r"(?:^|\s)-(?:exec|execdir|ok|okdir|fprintf|fprint|fprint0|delete)(?=\s|$)"
+    r"|(?:^|\s)--(?:pre|search-zip|hostname-bin)(?=[\s=]|$)"
+)
+
 
 @dataclass(frozen=True)
 class Decision:
@@ -162,6 +193,8 @@ def subject(tool_name: str, command: str = "") -> str | None:
     if _UNSAFE.search(raw):
         return None
     line = " ".join(raw.split())
+    if _ACTION.search(line):
+        return None
     return line or None
 
 

src/lembas/services/push.py

@@ -76,8 +76,10 @@ from sqlalchemy import select
 from sqlalchemy.orm import Session as DBSession
 
 from lembas.db.models import PushSubscription, User
+from lembas.services import fetch as fetch_service
 from lembas.services import settings_store
 from lembas.services.crypto import decrypt, encrypt
+from lembas.services.fetch import FetchError
 
 log = logging.getLogger(__name__)
 
@@ -274,6 +276,18 @@ async def send_one(db: DBSession, subscription: PushSubscription, payload: dict[
         "Authorization": f"vapid t={token}, k={keys(db).public_b64}",
     }
 
+    # Again, on a stored value. The subscribe route checks it too, but the row
+    # outlives that check: a name that pointed at a push service when it was
+    # registered can point inside the network later, and this is the side that
+    # actually opens the socket. The same split `agent/hosts.py` makes.
+    try:
+        fetch_service.check_url(subscription.endpoint)
+    except FetchError as exc:
+        log.warning(
+            "refusing to push to %s: %s", _audience(subscription.endpoint), exc.message
+        )
+        return False
+
     try:
         async with httpx.AsyncClient(timeout=10.0) as client:
             response = await client.post(subscription.endpoint, content=encrypted, headers=headers)

src/lembas/web/templates/library/_share_panel.html

@@ -56,8 +56,8 @@
       <label class="checkbox">
         <input type="checkbox" {{ 'checked' if on }}
                hx-post="/api/library/share/{{ kind }}/{{ resource.id }}"
-               hx-vals='{"principal_type": "group", "principal_id": "{{ group.id }}",
-                         "on": "{{ 'false' if on else 'true' }}", "q": "{{ q }}"}'
+               hx-vals='{{ {"principal_type": "group", "principal_id": group.id,
+                           "on": "false" if on else "true", "q": q} | tojson }}'
                hx-target="#share-panel"
                hx-swap="outerHTML">
         <span>{{ group.name }}</span>
@@ -76,8 +76,8 @@
       <label class="checkbox">
         <input type="checkbox" {{ 'checked' if on }}
                hx-post="/api/library/share/{{ kind }}/{{ resource.id }}"
-               hx-vals='{"principal_type": "user", "principal_id": "{{ person.id }}",
-                         "on": "{{ 'false' if on else 'true' }}", "q": "{{ q }}"}'
+               hx-vals='{{ {"principal_type": "user", "principal_id": person.id,
+                           "on": "false" if on else "true", "q": q} | tojson }}'
                hx-target="#share-panel"
                hx-swap="outerHTML">
         <span>{{ person.name }} <span class="faint text-xs">{{ person.email }}</span></span>