@warlock.js/ai-panoptic 4.14.0 → 4.16.0

package/CHANGELOG.md

@@ -4,6 +4,16 @@ All notable changes to `@warlock.js/ai-panoptic` are documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/). `@warlock.js/*` packages are released in lockstep — every package shares the same version number, so a version below may list only the changes that affected this package.
 
+## 4.16.0 - 2026-08-18
+
+### Security
+
+- **Dashboard stored XSS via `javascript:` markdown links — fixed.** The dashboard's markdown link renderer (`mdInline` in `ui.html.ts`) rewrote `[text](url)` into a live `<a href>` without validating the URL scheme, so a `javascript:` URL embedded in captured trace content (`span.input` / `span.output` under `captureContent` — i.e. prompt-injected model output or attacker-controlled tool results) became a stored XSS that fired when an operator clicked the link; the page's CSP (`script-src 'unsafe-inline'`) permits `javascript:` URI execution and does not restrict top-level navigation, putting the in-page bearer token in reach. Link URLs are now checked against a scheme allowlist (`http:`, `https:`, `mailto:`, plus relative/anchor URLs) after normalizing the URL the way a browser will — attribute-entity decode, strip of ignored control chars/whitespace (`java\tscript:`), lowercase — and scheme-relative `//host` links are rejected too; a rejected URL renders its label as plain text with no `href` at all. Regression-tested by executing the actual inlined client renderer against `javascript:`/`data:`/`vbscript:` payloads and their case/whitespace/entity obfuscations (`ui.html.md-links.spec.ts`)
+- **Dashboard token-handling hardening (3 residual findings from the same audit as the XSS above).** None of these are exploitable on their own today, but each widened the blast radius of a future bug:
+  - *Bearer token no longer a page-global.* `ui.html.ts`'s client script kept `TOKEN` as a `var` shared across its whole ~1000-line closure. It's now sealed inside its own inner IIFE that exposes only the `fetchAuthed` helper — code elsewhere in that closure (present or future) can no longer read the raw token by name.
+  - *Constant-time token comparison.* `serve.ts`'s `isAuthorized` compared the header/query token with plain `===`, which short-circuits on the first differing byte and is a textbook timing side-channel — the one scenario the package's own docs call out as realistic (`authToken` is required specifically when bound off-loopback, i.e. reachable over a network). Both the header and query-string checks now go through `crypto.timingSafeEqual` on length-checked, equal-length buffers.
+  - *Token-in-URL narrowed to the one route that needs it.* `?token=` is no longer accepted on the JSON API routes, only on the HTML page route. The page's own polling already re-sends the token as an `Authorization` header (fixed in 4.8.2), so the only request that structurally *can't* carry a header is the initial browser navigation that loads the HTML shell — that's the sole remaining query-string exposure, narrowing the token's footprint in access/proxy logs and browser history from every poll to one request.
+
 ## 4.12.0
 
 ### Changed

package/cjs/index.cjs

@@ -3,6 +3,7 @@ let _warlock_js_ai = require("@warlock.js/ai");
 let node_fs_promises = require("node:fs/promises");
 let node_path = require("node:path");
 let node_http = require("node:http");
+let node_crypto = require("node:crypto");
 let _warlock_js_logger = require("@warlock.js/logger");
 
 //#region ../ai-panoptic/src/exporters/utils/walk-spans.ts
@@ -2335,16 +2336,23 @@ function dashboardHtml(basePath, title, evaluateEnabled = false, evaluateDefault
   var EVALUATE_DEFAULT_INSTRUCTIONS = ${encodeForInlineScript(evaluateDefaultInstructions)};
 
   // Carry the ?token= the page itself was loaded with onto every
-  // subsequent poll — otherwise the API calls below inherit no auth and
-  // 401 forever once authToken is configured (the initial page load is
-  // the only request the URL's query string naturally reaches).
-  var TOKEN = new URLSearchParams(window.location.search).get("token");
-  function fetchAuthed(url, options) {
-    var opts = options || {};
-    var headers = opts.headers || {};
-    if (TOKEN) headers = Object.assign({}, headers, { Authorization: "Bearer " + TOKEN });
-    return fetch(url, Object.assign({}, opts, { headers: headers }));
-  }
+  // subsequent poll as an Authorization header — otherwise the API calls
+  // below inherit no auth and 401 forever once authToken is configured
+  // (the initial page load is the only request the URL's query string
+  // naturally reaches; the server only honors ?token= on that one route,
+  // see serve.ts). The token itself is kept in its own nested closure,
+  // not a plain var sitting alongside the rest of this file's top-level
+  // state, so it isn't trivially reachable from other code sharing this
+  // script's outer scope; only the fetchAuthed function it returns is.
+  var fetchAuthed = (function () {
+    var TOKEN = new URLSearchParams(window.location.search).get("token");
+    return function fetchAuthed(url, options) {
+      var opts = options || {};
+      var headers = opts.headers || {};
+      if (TOKEN) headers = Object.assign({}, headers, { Authorization: "Bearer " + TOKEN });
+      return fetch(url, Object.assign({}, opts, { headers: headers }));
+    };
+  })();
 
   var state = {
     traces: [], selectedId: null, selectedSpanId: null, collapsed: {}, sig: null,
@@ -2652,11 +2660,34 @@ function dashboardHtml(basePath, title, evaluateEnabled = false, evaluateDefault
     return out;
   }
 
+  // (S5) Markdown link URLs come from captured prompt/tool text — attacker-
+  // influenced content — so only http:, https:, mailto: and relative/anchor
+  // URLs may become an href; javascript:, data:, vbscript:, etc. must not.
+  // The check runs on the URL as the browser will act on it: undo the
+  // entities esc() introduced (the HTML parser decodes them exactly once in
+  // the attribute), strip the control chars / whitespace browsers ignore
+  // when parsing a scheme (java\\tscript:), and lowercase. Returns the
+  // original (still-escaped) URL when safe, or null to drop the link.
+  function sanitizeHref(url) {
+    var probe = url.replace(/&(amp|lt|gt|quot|#39);/g, function (m, name) {
+      return { amp: "&", lt: "<", gt: ">", quot: '"', "#39": "'" }[name];
+    });
+    probe = probe.replace(/[\\u0000-\\u0020\\u007f]+/g, "").toLowerCase();
+    if (/^[a-z][a-z0-9+.-]*:/.test(probe)) {
+      return /^(https?|mailto):/.test(probe) ? url : null;
+    }
+    if (/^[\\/\\\\]{2}/.test(probe)) return null; // scheme-relative smuggles a foreign host
+    return url;
+  }
   function mdInline(s) {
     s = s.replace(/\\*\\*([^*]+)\\*\\*/g, "<strong>$1</strong>");
     var codeRe = new RegExp(BT + "([^" + BT + "]+)" + BT, "g");
     s = s.replace(codeRe, "<code>$1</code>");
-    s = s.replace(/\\[([^\\]]+)\\]\\(([^)]+)\\)/g, '<a href="$2" target="_blank" rel="noopener">$1</a>');
+    s = s.replace(/\\[([^\\]]+)\\]\\(([^)]+)\\)/g, function (m, label, url) {
+      var href = sanitizeHref(url);
+      if (href === null) return label; // unsafe scheme: label as plain text, no <a>
+      return '<a href="' + href + '" target="_blank" rel="noopener">' + label + "</a>";
+    });
     return s;
   }
   function mdToHtml(raw) {
@@ -3509,11 +3540,41 @@ function hostHeaderName(hostHeader) {
 	const colon = hostHeader.indexOf(":");
 	return colon === -1 ? hostHeader : hostHeader.slice(0, colon);
 }
-/** Constant-ish bearer-token check from `Authorization` header or `?token=`. */
-function isAuthorized(req, url, token) {
+/**
+* Constant-time string equality (S4) — guards against a timing
+* side-channel that could otherwise let a network-adjacent attacker
+* recover the token byte-by-byte via repeated timed guesses. Plain `===`
+* short-circuits on the first differing byte, so response latency leaks
+* how many leading bytes matched; `timingSafeEqual` does not. Lengths are
+* compared first (a length mismatch is not secret and `timingSafeEqual`
+* requires equal-length buffers anyway).
+*/
+function constantTimeEqual(a, b) {
+	const bufA = Buffer.from(a);
+	const bufB = Buffer.from(b);
+	if (bufA.length !== bufB.length) return false;
+	return (0, node_crypto.timingSafeEqual)(bufA, bufB);
+}
+/**
+* Bearer-token check (S4): `Authorization: Bearer <token>` header, or
+* (only when `allowQueryToken`) a `?token=` query param.
+*
+* The query-string form only exists for the one request that structurally
+* cannot carry a custom header — the initial browser navigation that
+* loads the HTML shell (a typed/clicked/bookmarked URL). Every other
+* request the served page makes is same-origin `fetch()`, which can and
+* does set `Authorization` (see `ui.html.ts`'s `fetchAuthed`), so the API
+* routes never need to accept a query-string token. Restricting the
+* fallback to just the page route minimizes the token's exposure in
+* server access logs, proxy logs, and browser history to a single route
+* instead of every poll.
+*/
+function isAuthorized(req, url, token, allowQueryToken) {
 	const header = req.headers.authorization;
-	if (header && header === `Bearer ${token}`) return true;
-	return url.searchParams.get("token") === token;
+	if (header && constantTimeEqual(header, `Bearer ${token}`)) return true;
+	if (!allowQueryToken) return false;
+	const queryToken = url.searchParams.get("token");
+	return queryToken !== null && constantTimeEqual(queryToken, token);
 }
 /**
 * Build the `node:http` request handler for the dashboard over a given
@@ -3553,7 +3614,8 @@ function createRequestHandler(store, config) {
 			sendJson(res, 403, { error: "host_not_allowed" });
 			return;
 		}
-		if (config.authToken && !isAuthorized(req, url, config.authToken)) {
+		const isPageRoute = pathname === base || pathname === base.replace(/\/$/, "");
+		if (config.authToken && !isAuthorized(req, url, config.authToken, isPageRoute)) {
 			sendJson(res, 401, { error: "unauthorized" });
 			return;
 		}