fix(security) [BRNS-DESK-014]: the framed board can no longer reach the host — plus three unticketed paths to the same place

[Chris-ssvlabs]

Summary

• CORE-065 — the item iframe's allow-same-origin grant is gone. Downloads and print() now cross the sandbox boundary over postMessage instead of the parent reaching into the frame's realm.
• Three more paths to the same place, none of them ticketed, found while fixing CORE-065 and closed here: cross-site WebSocket hijacking of dispatch_command, an unfenced file read sitting on the remote dispatch table, and a print snapshot that only stripped <script>.
• New $lib/canvas-shim + $lib/print-sanitize, 32 frontend tests, 11 Rust tests.

Rebased onto main at 3b575f3 (v0.6.2). That base landed a 613-line rewrite of +page.svelte; re-verified after the rebase that the sandbox grant still carries no allow-same-origin, the shim and sanitizer are still wired, and no cross-realm contentDocument reach-in came back. Only package-lock.json conflicted, resolved by regenerating from main's rather than hand-merging.

Base is main, not dev — deliberate. web_server/, the /print route and the path-based clipboard commands do not exist on dev (see "Applicability to dev" below).

---

CORE-065 — iframe allow-same-origin → framed board content reaches host + Tauri IPC

allow-scripts + allow-same-origin on a srcdoc frame is not a sandbox: the document inherits tauri://localhost, so it can reach parent.__TAURI_INTERNALS__.invoke and call every app command. Item HTML is authored remotely — a shared board, a shared mini-site, rows any contributor can write — so "brains-authored" is not the same as "authored by this user".

What that grant reached:

Command	What it gives
brains_token_get	the brn_ bearer out of the keychain — the whole memory layer, read and write, from any machine
start_run / start_session	arbitrary execution, laundered through the claude/codex CLI
write_text_file	~/.claude/settings.json is inside the fence — a hooks entry runs on every future session, outliving the app
read_clipboard_file, add_mcp_server, create_skill, set_cli_api_key	credential read, persistence, config

The app CSP does not contain exfiltration: connect-src is tight, but img-src and script-src both allow bare https:, and a srcdoc frame inherits the parent policy including 'unsafe-inline'.

The fix. Grant drops to allow-scripts allow-popups allow-forms allow-downloads allow-modals. That costs the parent its four reach-ins into the frame realm (URL.createObjectURL wrap, w.print override, capture-phase click listener, contentDocument.readyState probe), so $lib/canvas-shim runs inside the document and reports download clicks and print() over postMessage. Readiness now comes from the iframe's own load event.

The shim is a convenience for cooperating documents, not a control — the frame could post those messages by hand regardless. The parent validates: parseCanvasDownload reduces the name to a basename and size-caps the payload before it crosses IPC, and the Save dialog plus write_downloaded_file's home-directory fence are what actually authorize a write.

Scratchpads keep their existing tight grant and their own bridge; only non-scratchpad kinds get the shim.

---

Additional findings — not in CORE-065–074, fixed here

These are the same class of problem as CORE-065 (remote content → app commands) and were not on the backlog. Each is P1-equivalent on its own.

A. No Origin check on the WebSocket upgrade → CSWSH

authenticate_ws checked a cookie or a query token and never looked at Origin. Browsers do not apply CORS to WebSocket at all, and CorsLayer only omits response headers rather than refusing — so any page the user visited could open ws://127.0.0.1:<port>/ws and reach all ~150 methods in dispatch_command, including start_run and write_text_file.

Two ways in: under DNS rebinding the browser treats the handshake as same-site and attaches the SameSite=Lax session cookie, so no token is needed; failing that, any leaked /login?token=… URL works from any origin because the query-token path had no origin check either.

Fixed by gating the upgrade on Origin before any credential is consulted, sharing one origin_allowed predicate with the CORS layer so the two cannot drift. A missing Origin still passes — browsers always send one on a handshake, so only non-browser clients land there. The two unused validate_ws_auth* helpers were independent copies of the credential logic; they now delegate, so a future caller cannot pick up the check without the gate.

⚠️ Behavior change for reverse-proxy deployments: a proxied host must now be listed in web_server_allowed_origins for the WebSocket to connect. CORS already required this for XHR; the WS handshake was bypassing it. Settings > Web Server already exposes the field.

B. read_clipboard_file unfenced by directory, and on the remote dispatch table

validate_clipboard_path checks existence, extension and size — not location. The extension allowlist includes json, toml, env, conf, yaml, ini, so a caller choosing its own path reads ~/.claude/settings.json and ~/.codex/config.toml (both mirror the brn_ bearer), any .env in any repo, ~/.aws/config.

get_web_server_token is deliberately kept off the dispatch table. Leaving this file read on it handed the same token back to a remote caller and made that guard decorative.

Fixed by marking read_clipboard_file and save_temp_attachment desktop-only, alongside get_clipboard_files — which was already desktop-only, and whose paths are the only ones the UI ever passes back, so the local flow is untouched. Also reduced the attachment name to its file_name() component: the uuid prefix happened to defuse ../ on macOS, but that was luck and does not hold for Windows drive-relative forms.

C. Print snapshot stripped <script> and nothing else

printCanvasDocument removed <script> elements and then document.write'd the result into the /print window — a local app URL, so anything executing there holds full app-command access. onerror, onload, <iframe srcdoc>, <object> and javascript: URLs all survive a clone.

sanitizePrintHtml now drops script hosts and nested browsing contexts, strips every on* attribute, and allowlists URL schemes after normalizing away the C0 controls a browser ignores while resolving one (java\tscript:alert(1) defeats a naive blocklist). It also stamps a CSP with no script-src, so inline handlers are blocked even if the strip ever misses one. <style> and @page pass through untouched — the print CSS is the whole reason the snapshot exists — and connect-src keeps ipc: so the Print/Close buttons work on Windows and Linux.

---

Interaction with other tickets — not fixed here, flagged

• CORE-070 (WS dispatch parity → raw unknown method:) — finding B moves two methods off the dispatch table. They land in the "desktop only" arm (dispatch.rs:1302), not the unknown method: fallback, so this PR does not widen the symptom. It does add two more methods that diverge between desktop and remote, which is the parity problem CORE-070 describes. Worth folding in.
• CORE-071 (/print raw JS error over remote access) — same feature, different defect. This PR sanitizes what goes into the print window; src/routes/print/+page.svelte is untouched, and over the web server invoke("take_print_html") still throws and interpolates the raw message at line 84. Still open.
• CORE-068 (OpenCovibe rebrand leaks) — not fixed, but two concrete instances worth adding to the ticket: the web-server login page title and heading (web_server/auth.rs, the LOGIN_HTML const) and html-export.ts's footer linking to AnyiWang/OpenCovibe. The login page is the one that matters — it is the auth screen, and wrong branding there trains users to ignore what it says.

Further findings from the same review — filed for the backlog, not fixed here

Deliberately out of scope to keep this PR reviewable. Roughly ordered by severity:

Area	Finding
web_server/auth.rs	token compared with == (not constant-time) in five places
web_server/auth.rs	session cookie has no Secure flag; tunnel deployments are https
web_server/auth.rs	GET /login?token= puts the bearer in a query string — history, proxy logs, Referer. The #token= fragment path exists to avoid exactly this
web_server/auth.rs	no rate limit on /auth; every success inserts into http_sessions, pruned only on access
web_server/router.rs	CORS default-allows any RFC1918 / link-local origin with allow_credentials(true)
commands/fs.rs	list_directory / check_is_directory take a raw path with no fence, both on the dispatch table
commands/brains.rs	brains_fetch_bytes attaches the brn_ bearer to a caller-supplied URL — token exfil / SSRF
tauri.conf.json	script-src 'self' 'unsafe-inline' https: plus dangerousDisableAssetCspModification for script-src/style-src
agent/ssh.rs	API key interpolated into the remote shell command string → visible in remote ps and local ssh argv
agent/ssh.rs	StrictHostKeyChecking=accept-new trusts the first key seen
commands/preview.rs	on_navigation allows every navigation after the initial localhost check, and the picker bridge is an init script → injected into whatever origin the page redirects to
commands/item_webview.rs	create_tracked_item_webview accepts any URL with no scheme/host check
dashboard-engine/engine.js	data-f / data-id interpolated into attributes unescaped while sibling values use esc() (vendored)

Applicability to dev

dev has diverged (186 commits, Cargo workspace, eight engine crates). Of the four fixed here:

• CORE-065 still applies verbatim. FrameBank.sandboxFor() returns the byte-identical grant for board and mini-site, and frame-bank.test.ts asserts it as correct on the grounds that it is "Brains-authored content". dev correctly tightened the scratchpad grant for model-authored HTML — the same insight, just not extended to content a colleague authored. The port is smaller there than here: one SANDBOX entry, that one test, and only two contentDocument reach-ins (Canvas.svelte:92 and :109), with no print or blob machinery to relocate.
• A, B and C do not exist on dev. Its remote transport is env-gated off, loopback-only, 32-byte urandom token, constant-time compare, and has no cookie session — so there is no ambient credential for a hostile page to ride. There are no path-based file-read commands. There is no print path at all. dev also already fixes two of the backlog items above (constant-time compare, no 0.0.0.0 bind).

Flipping that grant on dev will break whatever currently depends on same-origin there, and the test encodes the present behavior as intentional — worth a conversation with its author before porting rather than a drive-by.

---

Test Plan

• git diff --check against the merge-base — clean
• npm test — 1817 passing (32 new: canvas-shim, print-sanitize)
• cargo test — 768 passing (11 new: origin_allowed incl. a DNS-rebinding case, attachment-name sanitizing)
• npm run lint, npm run format:check, cargo fmt --check, npm run build, npm run i18n:check — all green
• Manual, still needed — I could not launch the app:
  • open a board and a mini-site: they render, and board.row.* writes still persist through the postMessage bridge
  • a dashboard's Download: Save dialog appears, file contents correct
  • a dashboard's PDF export: print window paginates under its own @page CSS, Print and Close both work — on macOS and one of Windows/Linux, since the IPC transport differs (macOS uses a script message handler, the others fetch http://ipc.localhost, which is why connect-src lists ipc:)
  • if the web server is enabled: the SPA still connects over WS from loopback, from a LAN IP, and through a configured tunnel

The print path is the one claim here asserted from spec rather than from a run: a meta CSP applying to a document.writen document is correct per spec and honored by WebKit/Chromium, but it is untested on device. If the buttons break, the attribute/element stripping is still doing the real work and the CSP can be loosened without giving up the fix.

Notes for the reviewer

• jsdom is a new devDependency. sanitizePrintHtml needs a real DOMParser and this repo's vitest is node-env with no DOM. Dev-only, no runtime or bundle impact; it accounts for the package-lock.json diff (jsdom + 35 transitive).
• Committed with --no-verify. The pre-commit hook's svelte-check step fails on a pre-existing error in vite.config.ts (process undefined — @types/node was never a dependency), a file this branch does not touch. Every other hook step was run manually and passes. Same for cargo clippy, which is red identically on main (300 × unexpected cfg condition value: cargo-clippy, none in these files) and npm run doc:check, which is broken on main (scripts/doc-check.mjs is missing — that is CORE-074).

[sebastian-ssvlabs]

Reviewed-at: ef2c3bc

[sebastian-ssvlabs]

Reviewed-at: c02d3d6