fix(apps): close credential leaks, endpoint XSS, and job effect escalation

Radin committed …

⧉20a94d43a324

Author

Radin · radin@coline.appOct 1, 2026 at 05:49

Committer

Radin · radin@coline.appOct 1, 2026 at 05:49

Parents

550a2d42a8ba

fix(apps): close credential leaks, endpoint XSS, and job effect escalation

From a Sol (GPT-6.1) review of the runtime, each verified against the code:

- Sync endpoint responses are app-controlled (body and content type) but
  were served on Coline's origin under the page CSP, so an endpoint could
  return HTML with a script that ran as Coline. They now get
  `sandbox; default-src 'none'` and nosniff (route and next.config).
- net.fetch returned responses verbatim, so a service that echoes request
  headers handed injected OAuth tokens and install secrets back to app
  code. Every injected value is scrubbed (raw, URL-encoded, base64) from
  response headers, body, and errors.
- accountUrl received the user's access token without a host check, and
  its label could carry a reflected token to app code. It must now be on
  the connection's hosts (manifest rule + runtime check), and a label
  containing the token is dropped.
- authorizeParams were applied after Coline's own parameters, so an app
  could replace redirect_uri (receiving the code) or state/PKCE/scope.
  Reserved names are rejected in the manifest and ignored at runtime
  (response_type is ignored, not rejected: `code` is a common harmless copy).
- jobs.enqueue ignored the caller's effect, so a write tool could start a
  destructive job that ran with the user's identity. A job's mutation
  class may no longer exceed its enqueuer's.
- Token-verified endpoints forwarded the token (custom header or query
  parameter) to the handler; it is removed after verification.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>