Fix review findings: secrets in snapshots, URL spoofing, migration data loss
Adversarial review of the branch produced findings across four areas. This addresses them, plus the Windows CI environment. Secrets. commit_container_snapshot baked the container's full env into the per-project snapshot image, so the shared OAuth token — and the AWS keys, git token and gateway master key — outlived revocation and were readable via docker inspect. Verified against Engine 29.6 that a commit body's config merges over the container's: keys cannot be dropped but can be overwritten, so all of them now commit as KEY=. clear_claude_token additionally rewrites images from earlier builds and reports honestly when a tag could not be rewritten. The recommendation to move the token out of env entirely was not taken, with reasoning: apiKeyHelper is a different auth method that outranks CLAUDE_CODE_OAUTH_TOKEN rather than a transport for it, and no file-based delivery exists. The durable exposure — the image — is what is closed here. Separately noted, not fixed: entrypoint.sh captures the token into the scheduler's .env inside the persisted volume. URL spoofing. Three call sites reached openUrl with container-controlled strings, one of which the review missed (the WebLinksAddon handler). The sign-in URL was scraped from container output with a longest-match tie-break and no userinfo check, so claude.ai@evil.tld rendered as "claude.ai…" in a truncating element. There is now one sanitizer in front of every sink — scheme allowlist, no userinfo, C0/C1 and quote rejection, host allowlist for the sign-in case, first-match — and the origin renders un-truncated. The toast is keyed so a changed URL remounts, closing a bait-and-switch where the user read one URL and clicked another. Migration. The rollback pin was best-effort: a tag failure was logged and the migration continued past remove_container, after which the final commit overwrote the only copy of the old system layer. It now aborts before anything destructive and reads the tag back. /var was destroyed while the ordinary recreate path preserves it — making the "safe" alternative to Reset more destructive than Reset's alternative; data-bearing subtrees are now detected and disclosed in the pre-flight rather than copied, since tarring a live database onto a different base's packages is a corruption risk. resume_migration now verifies the migration-state label instead of reporting success for a container that never swapped. dismiss actually resolves the record rather than leaving the feature permanently refusing to migrate. Start and Reset are guarded while a migration is live. Lifecycle. The gateway no longer publishes on 0.0.0.0 — bind address and advertised URL are derived together so they cannot drift. Disabling it now stops it. App exit runs teardown concurrently under a budget with a visible shutting-down state instead of blocking for minutes. Auto-starts retry when Docker is not up yet, and the polling-recovery path now reconciles, so interrupted migrations are still recovered. Auth-bridge forwards are capped, closing a container-driven fd exhaustion. Windows CI. build-windows failed on this branch with "linker link.exe not found". The runner had no MSVC build tools and the workflow assumed a hand-provisioned machine, so a bare runner registers, accepts jobs and fails at link time after downloading the whole crate graph. The job now installs the VC++ workload when vswhere cannot find it, matching how it already conditionally installs Rust and Node. 192 Rust tests, 274 frontend tests, both builds clean, zero warnings. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This commit is contained in:
Claude Opus 5
@@ -9,6 +9,11 @@ import {
|
||||
authErrorMessage,
|
||||
useClaudeTokenAcquisition,
|
||||
} from "../../hooks/useClaudeAuth";
|
||||
import {
|
||||
ANTHROPIC_SIGN_IN_HOSTS,
|
||||
sanitizeRelayUrl,
|
||||
urlOrigin,
|
||||
} from "../../lib/urlRelay";
|
||||
|
||||
interface Props {
|
||||
/** Project whose running container is borrowed to run the CLI. */
|
||||
@@ -85,11 +90,30 @@ export default function ClaudeAuthModal({
|
||||
? PHASE_STATUS.finishing
|
||||
: PHASE_STATUS.waiting;
|
||||
|
||||
// Split for display only. `flow.signInUrl` has already passed the host
|
||||
// allowlist; this decides which half of it an ellipsis is allowed to eat.
|
||||
const signInOrigin = flow.signInUrl ? (urlOrigin(flow.signInUrl) ?? "") : "";
|
||||
const signInPath = flow.signInUrl
|
||||
? flow.signInUrl.slice(signInOrigin.length)
|
||||
: "";
|
||||
|
||||
const handleOpen = async () => {
|
||||
if (!flow.signInUrl) return;
|
||||
setLinkError(null);
|
||||
// Re-validated at the sink. `extractSignInUrl` already applies the host
|
||||
// allowlist, so a failure here means that invariant broke — which is the
|
||||
// one moment it matters that the last step before the OS opener checks.
|
||||
const target = sanitizeRelayUrl(flow.signInUrl, {
|
||||
allowHosts: ANTHROPIC_SIGN_IN_HOSTS,
|
||||
});
|
||||
if (!target) {
|
||||
setLinkError(
|
||||
"That link is not an Anthropic sign-in address and was not opened. Start authentication again.",
|
||||
);
|
||||
return;
|
||||
}
|
||||
try {
|
||||
await openUrl(flow.signInUrl);
|
||||
await openUrl(target);
|
||||
} catch (e) {
|
||||
setLinkError(
|
||||
authErrorMessage(
|
||||
@@ -103,8 +127,19 @@ export default function ClaudeAuthModal({
|
||||
const handleCopy = async () => {
|
||||
if (!flow.signInUrl) return;
|
||||
setLinkError(null);
|
||||
// Copying is the manual route to the same browser, so it gets the same
|
||||
// check — a link too dangerous to open is too dangerous to hand over.
|
||||
const target = sanitizeRelayUrl(flow.signInUrl, {
|
||||
allowHosts: ANTHROPIC_SIGN_IN_HOSTS,
|
||||
});
|
||||
if (!target) {
|
||||
setLinkError(
|
||||
"That link is not an Anthropic sign-in address and was not copied. Start authentication again.",
|
||||
);
|
||||
return;
|
||||
}
|
||||
try {
|
||||
await navigator.clipboard.writeText(flow.signInUrl);
|
||||
await navigator.clipboard.writeText(target);
|
||||
setCopied(true);
|
||||
} catch (e) {
|
||||
setLinkError(
|
||||
@@ -185,16 +220,32 @@ export default function ClaudeAuthModal({
|
||||
{flow.signInUrl ? (
|
||||
<div className="mt-1 space-y-1.5">
|
||||
<div className="flex items-center gap-1.5">
|
||||
{/* The origin is rendered at full length and the path is the
|
||||
only part allowed to truncate. A single `truncate` element
|
||||
showing the whole URL is a spoofing primitive: pad the
|
||||
front and the ellipsis eats the half that decides where the
|
||||
user's Anthropic password goes. */}
|
||||
<a
|
||||
href={flow.signInUrl}
|
||||
onClick={(e) => {
|
||||
e.preventDefault();
|
||||
void handleOpen();
|
||||
}}
|
||||
className="min-w-0 flex-1 truncate px-2.5 py-1.5 font-mono text-xs text-[var(--accent)] hover:text-[var(--accent-hover)] bg-[var(--bg-primary)] border border-[var(--border-color)] rounded-[var(--radius-control)] transition-colors"
|
||||
className="flex min-w-0 flex-1 items-baseline px-2.5 py-1.5 font-mono text-xs text-[var(--accent)] hover:text-[var(--accent-hover)] bg-[var(--bg-primary)] border border-[var(--border-color)] rounded-[var(--radius-control)] transition-colors"
|
||||
title={flow.signInUrl}
|
||||
>
|
||||
{flow.signInUrl}
|
||||
<span
|
||||
data-testid="claude-auth-url-origin"
|
||||
className="shrink-0 font-semibold [overflow-wrap:anywhere]"
|
||||
>
|
||||
{signInOrigin}
|
||||
</span>
|
||||
<span
|
||||
data-testid="claude-auth-url-path"
|
||||
className="min-w-0 truncate text-[var(--text-secondary)]"
|
||||
>
|
||||
{signInPath}
|
||||
</span>
|
||||
</a>
|
||||
<Button size="md" onClick={() => void handleOpen()}>
|
||||
Open
|
||||
|
||||
Reference in New Issue
Block a user