mirror of
https://github.com/paperclipai/paperclip.git
synced 2026-10-21 08:22:20 +02:00
## Thinking Path > - Paperclip is the open source app people use to manage AI agents for work > - The server controls secrets, host files, outbound requests, and workspace commands > - A red-team review found cases where restricted callers could cross these trust boundaries > - These cases could expose credentials or let untrusted input reach privileged resources > - This pull request applies least-privilege checks at each affected server boundary > - The benefit is safer agent execution without changing the private-instance bootstrap contract ## Linked Issues or Issue Description **What happened?** Several server paths used authorization, redaction, or content-delivery rules that were too broad. Restricted agent keys could obtain company-level operational data. Some adapter and instruction paths could reach server-owned network or file resources without the required owner approval. **Expected behavior** Paperclip must redact credential values, enforce restricted-key scopes, guard outbound network access, prevent same-origin script execution, and reserve host-level file and command controls for authorized operators. **Steps to reproduce** 1. Configure an authenticated development instance at the parent commit. 2. Exercise the affected APIs with a restricted agent key or a non-instance-admin company user. 3. Observe that the parent commit returns privileged data or accepts a privileged operation. 4. Repeat on this branch and observe a redacted response, a safe download, or an HTTP 403 response. **Paperclip version or commit** The findings reproduce from commit `39898ab22` and are fixed by this pull request. **Deployment mode** Authenticated self-hosted server and local development modes. **Installation method** Built from source with pnpm. ## What Changed - Redact generic secret `value` and `token` fields recursively in structured logs. - Classify exact and separator-suffixed `KEY` environment names as secrets in company exports. - Limit restricted self-identity responses and protect company run, log, and secret catalog APIs. - Route HTTP adapter requests through DNS-pinned SSRF protection with exact private-origin allowlisting. - Download HTML, SVG, and other script-capable assets with `nosniff` and a sandbox CSP. - Require instance-admin access for external instruction roots and exports that read them. - Block agent-authenticated host command persistence across supported workspace runtime shapes. - Apply the central runtime-management decision before workspace command controls. - Keep the documented first-user instance-admin claim contract unchanged. - Add regression tests and server-owner configuration documentation. ## Verification - `pnpm -r typecheck` passes. - The Node 24 remediation suite passes with 365 tests. It skips 25 environment-gated tests. - `pnpm build` passes under Node 24. - `git diff --check` passes. - The full local runner reaches known macOS-only general-server harness failures before the serialized route lane. The Linux PR matrix is the authoritative full-suite gate. ## Risks - Restricted agent keys now receive HTTP 403 responses from company-wide run, log, and secret catalog endpoints. - Script-capable assets now download instead of rendering inline. - External instruction roots now require instance-admin access. - Private HTTP adapter endpoints now require an exact origin in `PAPERCLIP_HTTP_ADAPTER_PRIVATE_ENDPOINT_ALLOWLIST`. - Public HTTP adapter endpoints remain enabled. Redirects and metadata or link-local targets remain blocked. - No database migration is required. > For core feature work, check [`ROADMAP.md`](ROADMAP.md) first and discuss it in `#dev` before opening the PR. Feature PRs that overlap with planned core work may need to be redirected — check the roadmap first. See `CONTRIBUTING.md`. ## Model Used OpenAI Codex, GPT-5. The exact serving snapshot and context-window size are not exposed. The model used tool-enabled reasoning, repository access, code execution, and test execution. ## Checklist - [x] I have included a thinking path that traces from project context to this change - [x] I have specified the model used (with version and capability details) - [x] I have checked ROADMAP.md and confirmed this PR does not duplicate planned core work - [x] I have searched GitHub for duplicate or related PRs and linked them above - [x] I have either (a) linked existing issues with `Fixes: #` / `Closes #` / `Refs #` OR (b) described the issue in-PR following the relevant issue template - [x] I have not referenced internal/instance-local Paperclip issues or links (only public GitHub `#NNN` / `github.com/paperclipai/paperclip` URLs) - [x] My branch name describes the change (e.g. `docs/...`, `fix/...`) and contains no internal Paperclip ticket id or instance-derived details - [x] I have run tests locally and they pass - [x] I have added or updated tests where applicable - [x] I have updated relevant documentation to reflect my changes - [x] I have considered and documented any risks above - [x] All Paperclip CI gates are green - [x] Greptile is 5/5 with no open P2s, recommendations, or follow-ups - [x] I will address all Greptile and reviewer comments before requesting merge --------- Co-authored-by: Paperclip <noreply@paperclip.ing>
118 lines
3.4 KiB
TypeScript
118 lines
3.4 KiB
TypeScript
import type {
|
|
AdapterEnvironmentCheck,
|
|
AdapterEnvironmentTestContext,
|
|
AdapterEnvironmentTestResult,
|
|
} from "../types.js";
|
|
import { asString, parseObject } from "../utils.js";
|
|
import { guardedHttpAdapterFetch } from "./remote-fetch.js";
|
|
|
|
function summarizeStatus(checks: AdapterEnvironmentCheck[]): AdapterEnvironmentTestResult["status"] {
|
|
if (checks.some((check) => check.level === "error")) return "fail";
|
|
if (checks.some((check) => check.level === "warn")) return "warn";
|
|
return "pass";
|
|
}
|
|
|
|
function normalizeMethod(input: string): string {
|
|
const trimmed = input.trim();
|
|
return trimmed.length > 0 ? trimmed.toUpperCase() : "POST";
|
|
}
|
|
|
|
export async function testEnvironment(
|
|
ctx: AdapterEnvironmentTestContext,
|
|
): Promise<AdapterEnvironmentTestResult> {
|
|
const checks: AdapterEnvironmentCheck[] = [];
|
|
const config = parseObject(ctx.config);
|
|
const urlValue = asString(config.url, "");
|
|
const method = normalizeMethod(asString(config.method, "POST"));
|
|
|
|
if (!urlValue) {
|
|
checks.push({
|
|
code: "http_url_missing",
|
|
level: "error",
|
|
message: "HTTP adapter requires a URL.",
|
|
hint: "Set adapterConfig.url to an absolute http(s) endpoint.",
|
|
});
|
|
return {
|
|
adapterType: ctx.adapterType,
|
|
status: summarizeStatus(checks),
|
|
checks,
|
|
testedAt: new Date().toISOString(),
|
|
};
|
|
}
|
|
|
|
let url: URL | null = null;
|
|
try {
|
|
url = new URL(urlValue);
|
|
} catch {
|
|
checks.push({
|
|
code: "http_url_invalid",
|
|
level: "error",
|
|
message: `Invalid URL: ${urlValue}`,
|
|
});
|
|
}
|
|
|
|
if (url && url.protocol !== "http:" && url.protocol !== "https:") {
|
|
checks.push({
|
|
code: "http_url_protocol_invalid",
|
|
level: "error",
|
|
message: `Unsupported URL protocol: ${url.protocol}`,
|
|
hint: "Use an http:// or https:// endpoint.",
|
|
});
|
|
}
|
|
|
|
if (url) {
|
|
checks.push({
|
|
code: "http_url_valid",
|
|
level: "info",
|
|
message: `Configured endpoint: ${url.toString()}`,
|
|
});
|
|
}
|
|
|
|
checks.push({
|
|
code: "http_method_configured",
|
|
level: "info",
|
|
message: `Configured method: ${method}`,
|
|
});
|
|
|
|
if (url && (url.protocol === "http:" || url.protocol === "https:")) {
|
|
const controller = new AbortController();
|
|
const timeout = setTimeout(() => controller.abort(), 3000);
|
|
try {
|
|
const response = await guardedHttpAdapterFetch(url, {
|
|
method: "HEAD",
|
|
signal: controller.signal,
|
|
});
|
|
if (!response.ok && response.status !== 405 && response.status !== 501) {
|
|
checks.push({
|
|
code: "http_endpoint_probe_unexpected_status",
|
|
level: "warn",
|
|
message: `Endpoint probe returned HTTP ${response.status}.`,
|
|
hint: "Verify the endpoint is reachable from the Paperclip server host.",
|
|
});
|
|
} else {
|
|
checks.push({
|
|
code: "http_endpoint_probe_ok",
|
|
level: "info",
|
|
message: "Endpoint responded to a HEAD probe.",
|
|
});
|
|
}
|
|
} catch (err) {
|
|
checks.push({
|
|
code: "http_endpoint_probe_failed",
|
|
level: "warn",
|
|
message: err instanceof Error ? err.message : "Endpoint probe failed",
|
|
hint: "This may be expected in restricted networks; verify connectivity when invoking runs.",
|
|
});
|
|
} finally {
|
|
clearTimeout(timeout);
|
|
}
|
|
}
|
|
|
|
return {
|
|
adapterType: ctx.adapterType,
|
|
status: summarizeStatus(checks),
|
|
checks,
|
|
testedAt: new Date().toISOString(),
|
|
};
|
|
}
|