Harden runtime security boundaries

Author: dzarlax

config/config.yaml

@@ -111,6 +111,9 @@ admin_api:
   token: ${ADMIN_API_TOKEN}
   trust_forward_auth: true
   forward_auth_header: X-authentik-username
+  trusted_proxy_cidrs:
+    - 127.0.0.1/32
+    - ::1/128
   base_url: https://assistant.dzarlax.dev
 
 # Artificial Analysis API — overlays Intelligence Index scores onto model capabilities.

internal/adminapi/adminapi_test.go

@@ -45,8 +45,8 @@ func TestTemplatesParse(t *testing.T) {
 		CatalogProvider: "openrouter",
 	}
 	cases := map[string]any{
-		viewIndex:       data,
-		viewRouting:     data.Routing, // routing view takes uiRouting directly
+		viewIndex:         data,
+		viewRouting:       data.Routing, // routing view takes uiRouting directly
 		viewModelsBrowser: data,
 	}
 	for v, d := range cases {
@@ -135,6 +135,7 @@ func TestAuthForwardAuth(t *testing.T) {
 	s := newTestServer(t)
 	s.cfg.TrustForwardAuth = true
 	s.cfg.ForwardAuthHeader = "X-authentik-username"
+	s.cfg.TrustedProxyCIDRs = []string{"127.0.0.1/32", "::1/128"}
 	mux := http.NewServeMux()
 	s.registerRoutes(mux)
 	srv := httptest.NewServer(mux)
@@ -164,6 +165,32 @@ func TestAuthForwardAuth(t *testing.T) {
 	}
 }
 
+func TestAuthForwardAuthRequiresTrustedProxy(t *testing.T) {
+	s := newTestServer(t)
+	s.cfg.TrustForwardAuth = true
+	s.cfg.ForwardAuthHeader = "X-authentik-username"
+	s.cfg.TrustedProxyCIDRs = []string{"10.0.0.0/8"}
+
+	called := false
+	handler := s.requireAuth(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		called = true
+		w.WriteHeader(http.StatusOK)
+	}))
+
+	req := httptest.NewRequest(http.MethodGet, "/routing", nil)
+	req.RemoteAddr = "203.0.113.10:5555"
+	req.Header.Set("X-authentik-username", "alice")
+	rec := httptest.NewRecorder()
+	handler.ServeHTTP(rec, req)
+
+	if called {
+		t.Fatal("forward-auth handler should not be called for an untrusted remote")
+	}
+	if rec.Code != http.StatusUnauthorized {
+		t.Fatalf("got %d, want %d", rec.Code, http.StatusUnauthorized)
+	}
+}
+
 // TestHealthz: always reachable.
 func TestHealthz(t *testing.T) {
 	s := newTestServer(t)

internal/adminapi/auth.go

@@ -2,7 +2,10 @@ package adminapi
 
 import (
 	"crypto/subtle"
+	"log/slog"
+	"net"
 	"net/http"
+	"net/netip"
 	"strings"
 )
 
@@ -23,7 +26,7 @@ const authCookieName = "admin_auth"
 func (s *Server) requireAuth(next http.Handler) http.Handler {
 	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		// 1. Forward-auth (Authentik via Traefik).
-		if s.cfg.TrustForwardAuth && r.Header.Get(s.cfg.ForwardAuthHeader) != "" {
+		if s.cfg.TrustForwardAuth && r.Header.Get(s.cfg.ForwardAuthHeader) != "" && s.requestFromTrustedForwardAuthProxy(r) {
 			next.ServeHTTP(w, r)
 			return
 		}
@@ -72,3 +75,33 @@ func (s *Server) tokenMatches(got string) bool {
 	}
 	return subtle.ConstantTimeCompare([]byte(got), []byte(s.cfg.Token)) == 1
 }
+
+func (s *Server) requestFromTrustedForwardAuthProxy(r *http.Request) bool {
+	if len(s.cfg.TrustedProxyCIDRs) == 0 {
+		s.logger.Warn("forward-auth header ignored: no trusted proxy CIDRs configured")
+		return false
+	}
+	host, _, err := net.SplitHostPort(r.RemoteAddr)
+	if err != nil {
+		host = r.RemoteAddr
+	}
+	addr, err := netip.ParseAddr(host)
+	if err != nil {
+		s.logger.Warn("forward-auth header ignored: invalid remote address", "remote_addr", r.RemoteAddr)
+		return false
+	}
+	for _, raw := range s.cfg.TrustedProxyCIDRs {
+		prefix, err := netip.ParsePrefix(strings.TrimSpace(raw))
+		if err != nil {
+			s.logger.Warn("forward-auth trusted proxy CIDR ignored", "cidr", raw, "err", err)
+			continue
+		}
+		if prefix.Contains(addr) {
+			return true
+		}
+	}
+	s.logger.Warn("forward-auth header ignored: untrusted remote address",
+		slog.String("remote_addr", r.RemoteAddr),
+	)
+	return false
+}

internal/adminapi/templates/chat.html

@@ -203,10 +203,67 @@
     // ============================================================
     // Markdown rendering + code copy buttons.
     // ============================================================
+    function sanitizeMarkdownHTML(html) {
+      var tpl = document.createElement('template');
+      tpl.innerHTML = html || '';
+      var allowedTags = {
+        A: true, B: true, BLOCKQUOTE: true, BR: true, CODE: true, DEL: true,
+        EM: true, H1: true, H2: true, H3: true, H4: true, H5: true, H6: true,
+        HR: true, I: true, LI: true, OL: true, P: true, PRE: true, S: true,
+        SPAN: true, STRONG: true, TABLE: true, TBODY: true, TD: true, TH: true,
+        THEAD: true, TR: true, UL: true
+      };
+      var allowedAttrs = {
+        A: { href: true, title: true },
+        CODE: { class: true },
+        SPAN: { class: true },
+        TH: { align: true },
+        TD: { align: true }
+      };
+      function safeURL(value) {
+        try {
+          var u = new URL(value, window.location.origin);
+          return u.protocol === 'http:' || u.protocol === 'https:' || u.protocol === 'mailto:';
+        } catch (_) {
+          return false;
+        }
+      }
+      function clean(node) {
+        Array.from(node.childNodes).forEach(function(child) {
+          if (child.nodeType === Node.TEXT_NODE) return;
+          if (child.nodeType !== Node.ELEMENT_NODE) {
+            child.remove();
+            return;
+          }
+          if (!allowedTags[child.tagName]) {
+            child.replaceWith(document.createTextNode(child.textContent || ''));
+            return;
+          }
+          Array.from(child.attributes).forEach(function(attr) {
+            var name = attr.name.toLowerCase();
+            var tagAttrs = allowedAttrs[child.tagName] || {};
+            if (!tagAttrs[name]) {
+              child.removeAttribute(attr.name);
+              return;
+            }
+            if (name === 'href' && !safeURL(attr.value)) {
+              child.removeAttribute(attr.name);
+            }
+          });
+          if (child.tagName === 'A' && child.getAttribute('href')) {
+            child.setAttribute('rel', 'noopener noreferrer');
+            child.setAttribute('target', '_blank');
+          }
+          clean(child);
+        });
+      }
+      clean(tpl.content);
+      return tpl.innerHTML;
+    }
     function renderMarkdown(root) {
       (root || document).querySelectorAll('.chat-msg__body.md[data-md]').forEach(function(el) {
         if (el.dataset.rendered) return;
-        el.innerHTML = marked.parse(el.dataset.md || '');
+        el.innerHTML = sanitizeMarkdownHTML(marked.parse(el.dataset.md || ''));
         el.dataset.rendered = '1';
         hydrateCodeBlocks(el);
       });
@@ -513,7 +570,11 @@
         }
       } catch (err) {
         if (err.name !== 'AbortError') {
-          bot.body.innerHTML = '<span class="chat-error">Error: ' + (err.message || err) + '</span>';
+          bot.body.textContent = '';
+          var errSpan = document.createElement('span');
+          errSpan.className = 'chat-error';
+          errSpan.textContent = 'Error: ' + (err.message || err);
+          bot.body.appendChild(errSpan);
         } else {
           bot.body.innerHTML = '<span class="chat-error">Stopped.</span>';
         }
@@ -557,7 +618,7 @@
           var md = document.createElement('div');
           md.className = 'chat-msg__body md';
           md.dataset.md = final;
-          md.innerHTML = marked.parse(final);
+          md.innerHTML = sanitizeMarkdownHTML(marked.parse(final));
           md.dataset.rendered = '1';
           hydrateCodeBlocks(md);
           bot.body.replaceWith(md);
@@ -572,7 +633,11 @@
       } else if (ev.event === 'error') {
         try {
           var e = JSON.parse(ev.data);
-          bot.body.innerHTML = '<span class="chat-error">Error: ' + (e.message || 'unknown') + '</span>';
+          bot.body.textContent = '';
+          var errEl = document.createElement('span');
+          errEl.className = 'chat-error';
+          errEl.textContent = 'Error: ' + (e.message || 'unknown');
+          bot.body.appendChild(errEl);
         } catch (_) {
           bot.body.innerHTML = '<span class="chat-error">Error</span>';
         }