mirror of
https://github.com/fabro-sh/fabro.git
synced 2026-10-12 03:51:01 +00:00
d58e722647
HTTP-hook headers carry credentials, so a `{{ env.NAME }}` token in a
header value must only resolve env vars the hook explicitly opts into via
`allowed_env_vars`. The typed-interpolation rewrite dropped that
allowlist: headers resolved any `{{ env.* }}` while `allowed_env_vars`
was parsed, carried, and documented but ignored in the executor — a
silent fail-open regression.
Restore the allowlist as a fail-closed control without reviving the
removed template env API. Header values now resolve through a scoped env
lookup that returns a value only for names in the hook's
`allowed_env_vars` and `None` otherwise, so a non-allowlisted
`{{ env.X }}` resolves as absent (Missing) and the hook blocks before
firing — never sending a half-resolved or empty credential header. An
empty `allowed_env_vars` permits no env vars in headers, matching the
prior behavior. The allowlist applies only to headers; url, command,
prompt, and model keep no allowlist.
Also:
- Correct the resolve helper doc comments to say env is the only wired
namespace; secrets/vars/inputs are unavailable here and fail closed.
- Log the unresolved URL token source instead of the resolved URL on
header/URL resolution failures, so a URL-embedded credential cannot
leak into logs.
- Update the hooks docs and the OpenAPI `headers`/`allowed_env_vars`
descriptions to document `{{ env.NAME }}` token interpolation and the
enforced header allowlist.
Tests cover both directions: an allowlisted var resolves and the header
is sent, while a non-allowlisted var blocks and never fires the request.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
|
||
|---|---|---|
| .. | ||
| hooks.mdx | ||
| mcp.mdx | ||
| outputs.mdx | ||
| permissions.mdx | ||
| prompts.mdx | ||
| skills.mdx | ||
| subagents.mdx | ||
| tools.mdx | ||