fix(security): validate haproxy.acl.path + haproxy.acl.header at parse time

The audit's P2-10 framing was "drop the dead ACLPath/ACLHeader fields,"
but those labels are documented in
ubuntu-ha-proxy-install/docs/architecture.md and
ubuntu-ha-proxy-install/docs/example-docker-compose.yml as supported
forward-looking features ("Path-based routing", "Custom ACL conditions").
Deleting the BackendConfig fields would break that documented API.

Instead, validate them now so the latent injection class (same shape as
P0-1 BackendName and P0-2 ACLIP) is closed before any future PR wires
them into a generated directive like:

  acl req_path path_beg <path>
  acl req_hdr_cnt(<header>) gt 0

Two new validators in parser.go:

- validACLPath: leading slash + URL-path-safe charset
  (`^/[a-zA-Z0-9/_.\-~%]*$`). Rejects embedded newlines, semicolons,
  whitespace, query strings, fragments.

- validACLHeader: RFC 7230 HTTP header token characters
  (`^[a-zA-Z0-9!#$%&'*+\-.^_`+"`"+`|~]+$`). Rejects newlines, colons,
  slashes, spaces.

extractBackendConfig now rejects the whole backend if either field has
a non-empty malformed value. Empty values (the overwhelmingly common
case) skip validation as today.

Tests cover the legitimate-shape pass list, the injection class
(newline + HAProxy directive payload), and the common-injection-
character reject list.

P2-10 from the 2026-05 security audit.

Author: sarg3nt

gearbox-agent/internal/framework/services/compose/parser.go

@@ -43,6 +43,18 @@ var (
 	// newline / directive injection from a Docker Compose label into the
 	// generated haproxy.cfg (see 2026-05 security audit, P0-1).
 	validBackendName = regexp.MustCompile(`^[a-zA-Z0-9_][a-zA-Z0-9_.\-]{0,62}$`)
+	// validACLPath matches a URL path component for an HAProxy path-based
+	// ACL: leading `/`, then a safe URL-path character set. Used for the
+	// `haproxy.acl.path` label, which is currently parsed into BackendConfig
+	// but not yet wired into the generator. Validating now closes the
+	// latent injection class — if a future PR wires this into a generated
+	// `acl req_path path_beg %s` directive, no flag/newline can slip
+	// through. See 2026-05 security audit, P2-10.
+	validACLPath = regexp.MustCompile(`^/[a-zA-Z0-9/_.\-~%]*$`)
+	// validACLHeader matches an HTTP header name (RFC 7230 token chars).
+	// Same forward-looking rationale as validACLPath: parsed but not yet
+	// generated, validated now.
+	validACLHeader = regexp.MustCompile(`^[a-zA-Z0-9!#$%&'*+\-.^_` + "`" + `|~]+$`)
 )
 
 // validateACLIPList validates a comma-separated list of IPs/CIDRs against
@@ -312,6 +324,31 @@ func (p *Parser) extractBackendConfig(labels map[string]string, appName, service
 		return nil
 	}
 
+	// 2026-05 audit P2-10: haproxy.acl.path and haproxy.acl.header are
+	// documented labels (see ubuntu-ha-proxy-install/docs/) that gearbox-
+	// agent parses today but does NOT yet emit into the generated config.
+	// Validate them here so the latent injection class is closed BEFORE
+	// any future PR wires them into a directive like
+	// `acl req_path path_beg <path>` or `acl req_hdr_cnt(<header>) gt 0`.
+	// Empty is accepted (the common case); non-empty must match the
+	// allow-list pattern, otherwise the backend is rejected.
+	aclPath := labels[LabelPrefix+"acl.path"]
+	if aclPath != "" && !validACLPath.MatchString(aclPath) {
+		p.logger.Warn("Invalid haproxy.acl.path value; rejecting backend",
+			"app", appName,
+			"service", serviceName,
+		)
+		return nil
+	}
+	aclHeader := labels[LabelPrefix+"acl.header"]
+	if aclHeader != "" && !validACLHeader.MatchString(aclHeader) {
+		p.logger.Warn("Invalid haproxy.acl.header value; rejecting backend",
+			"app", appName,
+			"service", serviceName,
+		)
+		return nil
+	}
+
 	// Get and validate configurable values with safe defaults
 	mode := getValidatedOrDefault(labels, LabelPrefix+"backend.mode", "http", validMode)
 	balance := getValidatedOrDefault(labels, LabelPrefix+"backend.balance", "roundrobin", validBalance)
@@ -334,8 +371,8 @@ func (p *Parser) extractBackendConfig(labels map[string]string, appName, service
 		CheckFall:        checkFall,
 		CheckRise:        checkRise,
 		SSLRedirect:      labels[LabelPrefix+"ssl.redirect"] != "false",
-		ACLPath:          labels[LabelPrefix+"acl.path"],
-		ACLHeader:        labels[LabelPrefix+"acl.header"],
+		ACLPath:          aclPath,
+		ACLHeader:        aclHeader,
 		Public:           labels[LabelPrefix+"public"] == "true",
 		RateLimit:        rateLimit,
 		ACLIP:            aclIP,

gearbox-agent/internal/framework/services/compose/parser_test.go

@@ -757,3 +757,104 @@ func TestParseFile_InjectionViaACLIP(t *testing.T) {
 		t.Errorf("ParseFile() returned %d backend(s) for an injection payload; want 0 (rejected)", len(backends))
 	}
 }
+
+// 2026-05 audit P2-10: haproxy.acl.path and haproxy.acl.header are
+// validated at parse time even though no current generator emits them.
+// Closes the latent injection class before a future PR wires them in.
+func TestValidACLPath(t *testing.T) {
+	tests := []struct {
+		name  string
+		input string
+		want  bool
+	}{
+		{"empty", "", true}, // empty handled by call-site short-circuit
+		{"root", "/", true},
+		{"single-segment", "/api", true},
+		{"multi-segment", "/api/v1/users", true},
+		{"trailing-slash", "/api/", true},
+		{"with-dash-underscore", "/api/_v2-beta", true},
+		{"url-encoded-allowed", "/api/%20space", true},
+
+		{"no-leading-slash", "api", false},
+		{"newline-injection", "/api\n  http-request deny", false},
+		{"semicolon", "/api; default-src *", false},
+		{"space", "/api /v1", false},
+		{"backslash", "/api\\v1", false},
+		{"query-string", "/api?x=1", false},
+		{"fragment", "/api#section", false},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if tt.input == "" {
+				return // call-site skips validation for empty
+			}
+			if got := validACLPath.MatchString(tt.input); got != tt.want {
+				t.Errorf("validACLPath.MatchString(%q) = %v, want %v", tt.input, got, tt.want)
+			}
+		})
+	}
+}
+
+func TestValidACLHeader(t *testing.T) {
+	tests := []struct {
+		name  string
+		input string
+		want  bool
+	}{
+		{"simple", "X-Custom-Header", true},
+		{"all-lower", "authorization", true},
+		{"underscore", "X_Custom", true},
+		{"dot-allowed-by-rfc", "X.Forwarded.For", true},
+
+		{"empty", "", false},
+		{"space", "X Custom", false},
+		{"newline-injection", "X-Custom\nhttp-request deny", false},
+		{"semicolon", "X-Custom;evil", false},
+		{"colon", "X-Custom:value", false},
+		{"slash", "X-Custom/extra", false},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if got := validACLHeader.MatchString(tt.input); got != tt.want {
+				t.Errorf("validACLHeader.MatchString(%q) = %v, want %v", tt.input, got, tt.want)
+			}
+		})
+	}
+}
+
+func TestParseFile_InjectionViaACLPath(t *testing.T) {
+	// 2026-05 audit P2-10: even though the generator doesn't emit
+	// haproxy.acl.path today, a malicious value must not be stored on
+	// BackendConfig — otherwise a future generator wire-up would re-open
+	// the P0-1/P0-2 class of injection.
+	tmpDir := t.TempDir()
+	appDir := filepath.Join(tmpDir, "aclpath")
+	if err := os.MkdirAll(appDir, 0755); err != nil {
+		t.Fatalf("MkdirAll: %v", err)
+	}
+
+	composeContent := "services:\n" +
+		"  web:\n" +
+		"    image: nginx\n" +
+		"    labels:\n" +
+		"      haproxy.enable: \"true\"\n" +
+		"      haproxy.hostname: \"evil.example.com\"\n" +
+		"      haproxy.backend.server: \"10.0.0.1:80\"\n" +
+		"      haproxy.acl.path: |\n" +
+		"        /api\n" +
+		"          http-request deny\n"
+
+	composePath := filepath.Join(appDir, "docker-compose.yml")
+	if err := os.WriteFile(composePath, []byte(composeContent), 0644); err != nil {
+		t.Fatalf("WriteFile: %v", err)
+	}
+
+	parser := NewParser(tmpDir, testLogger())
+	backends, err := parser.ParseFile(composePath)
+	if err != nil {
+		t.Fatalf("ParseFile: %v", err)
+	}
+	if len(backends) != 0 {
+		t.Errorf("ParseFile returned %d backend(s); want 0 (rejected on aclpath injection)", len(backends))
+	}
+}