fix(security): close 4 STILL-REAL advisory findings (ACP RCE hardening, db-backups tier, uppercase authz bypass, spawn-veto drift) (#11028)

⭐5 — 4 achados STILL-REAL de advisories de segurança, cada um com TDD (RED→GREEN) e crédito ao reporter original: ACP RCE hardening (resolveVersionProbe), db-backups Tier-2 allowlist, uppercase authz bypass (matcher case-insensitive), spawn-veto drift (chatgpt-web-codex-doctor). typecheck/lint limpos, suíte authz/acp/cors verde. UNSTABLE é o base-red inherited #9985, já documentado no corpo da PR.

src/lib/acp/registry.ts

@@ -200,6 +200,14 @@ let _customAgentDefs: CustomAgentDef[] = [];
 
 const DISALLOWED_VERSION_COMMAND_CHARS = /[;&|<>`$\r\n]/;
 
+// A version probe only ever needs a version flag. For untrusted (client-registered)
+// custom agents the binary-match check alone is not enough: the caller controls both
+// `binary` and `versionCommand`, so a matching interpreter with an eval-style argument
+// (`node -e …`, `python -c …`, `ruby -e …`) reaches execFileSync as arbitrary code
+// execution without any shell metacharacter. Restricting the args to a recognized
+// version flag closes that path — see GHSA-jphr-2gw7-xrwp / GHSA-hf57-cqmx-p4gr.
+const SAFE_VERSION_PROBE_ARG = /^(-v|-V|--version|-version|version|--ver)$/;
+
 /**
  * Set custom agent definitions from settings.
  */
@@ -300,6 +308,12 @@ export function resolveVersionProbe(
     if (!allowed.has(normalizedCommand)) {
       return null;
     }
+
+    // Untrusted probe: allow only a bare binary or a single recognized version
+    // flag, so a matching interpreter cannot smuggle an eval/exec argument.
+    if (args.length > 1 || (args.length === 1 && !SAFE_VERSION_PROBE_ARG.test(args[0]))) {
+      return null;
+    }
   }
 
   return { command, args };

src/proxy.ts

@@ -24,6 +24,14 @@ export async function proxy(request: NextRequest) {
   return runAuthzPipeline(request, { enforce: true });
 }
 
+// Next compiles the middleware/proxy matcher from `regexp.source` only, dropping
+// path-to-regexp's default case-insensitive flag — so a lowercase literal like
+// `/v1/:path*` never matches `/V1/...`, while the rewrite matcher (flag kept)
+// still routes it to the handler. That skipped the authz pipeline entirely
+// (GHSA-jvqc-mp9f-q936). Expressing the case-insensitivity inside a custom
+// path-to-regexp group (`([vV]1)`) survives the flag-drop because it needs no
+// flag. Keep these in sync with the client-API aliases in
+// next.config.mjs rewrites and src/server/authz/classify.ts.
 export const config = {
   matcher: [
     "/",
@@ -31,15 +39,15 @@ export const config = {
     "/home",
     "/home/:path*",
     "/api/:path*",
-    "/v1/:path*",
-    "/v1",
-    "/v1beta/:path*",
-    "/v1beta",
-    "/chat/:path*",
-    "/responses/:path*",
-    "/responses",
-    "/codex/:path*",
-    "/codex",
-    "/models",
+    "/:v1seg([vV]1)/:path*",
+    "/:v1seg([vV]1)",
+    "/:v1betaseg([vV]1[bB][eE][tT][aA])/:path*",
+    "/:v1betaseg([vV]1[bB][eE][tT][aA])",
+    "/:chatseg([cC][hH][aA][tT])/:path*",
+    "/:respseg([rR][eE][sS][pP][oO][nN][sS][eE][sS])/:path*",
+    "/:respseg([rR][eE][sS][pP][oO][nN][sS][eE][sS])",
+    "/:codexseg([cC][oO][dD][eE][xX])/:path*",
+    "/:codexseg([cC][oO][dD][eE][xX])",
+    "/:modelsseg([mM][oO][dD][eE][lL][sS])",
   ],
 };

src/server/authz/classify.ts

@@ -16,30 +16,39 @@ function normalizePathname(rawPath: string): { path: string; reason?: Classifica
   if (!path.startsWith("/")) path = "/" + path;
   if (path.length > 1 && path.endsWith("/")) path = path.slice(0, -1);
 
-  if (path === "/codex" || path.startsWith("/codex/")) {
+  // Client-API aliases are matched case-insensitively on the control segment.
+  // Next's rewrite layer accepts `/V1/...`, `/CODEX`, etc. and routes them to
+  // the client handler, so the classifier must recognize the same casing —
+  // otherwise an uppercase alias falls through to the management fallback and
+  // the request is treated as a different route class than it is actually
+  // dispatched to (GHSA-jvqc-mp9f-q936). Only the leading control segment is
+  // lowercased for detection; the original-case tail is preserved.
+  const lower = path.toLowerCase();
+
+  if (lower === "/codex" || lower.startsWith("/codex/")) {
     return { path: "/api/v1/responses", reason: "client_api_codex_alias" };
   }
 
-  if (path === "/v1/v1" || path.startsWith("/v1/v1/")) {
+  if (lower === "/v1/v1" || lower.startsWith("/v1/v1/")) {
     const tail = path.slice("/v1/v1".length) || "";
     return { path: "/api/v1" + tail, reason: "client_api_double_prefix" };
   }
 
-  if (path === "/v1beta" || path.startsWith("/v1beta/")) {
+  if (lower === "/v1beta" || lower.startsWith("/v1beta/")) {
     const tail = path.slice("/v1beta".length) || "";
     return { path: "/api/v1beta" + tail, reason: "client_api_alias" };
   }
 
-  if (path === "/v1" || path.startsWith("/v1/")) {
+  if (lower === "/v1" || lower.startsWith("/v1/")) {
     const tail = path.slice("/v1".length) || "";
     return { path: "/api/v1" + tail, reason: "client_api_alias" };
   }
 
   for (const { alias, canonical } of CLIENT_API_ALIAS_PREFIXES) {
-    if (path === alias) {
+    if (lower === alias) {
       return { path: canonical, reason: "client_api_alias" };
     }
-    if (path.startsWith(alias + "/")) {
+    if (lower.startsWith(alias + "/")) {
       return { path: canonical + path.slice(alias.length), reason: "client_api_alias" };
     }
   }

src/server/authz/routeGuard.ts

@@ -119,6 +119,11 @@ export const ALWAYS_PROTECTED_API_PATHS: ReadonlyArray<string> = [
   "/api/shutdown",
   "/api/providers/health-autopilot/actions",
   "/api/settings/database",
+  // Full-database export/import: a credential dump and an irreversible replace.
+  // Must stay authenticated even under requireLogin=false, for the same reason
+  // /api/settings/database already does. isAlwaysProtectedPath matches on a path
+  // boundary, so this covers export, exportAll and import. (GHSA-mghq-58h3-qcqj)
+  "/api/db-backups",
 ];
 
 export function isLoopbackHost(hostHeader: string | null): boolean {

src/shared/constants/spawnCapablePrefixes.ts

@@ -52,6 +52,7 @@ export const SPAWN_CAPABLE_PATTERNS: ReadonlyArray<RegExp> = [
   /^\/api\/providers\/[^/]+\/login\/?$/, // pre-existing gap: in LOCAL_ONLY_API_PATTERNS today but never in a spawn-capable deny-list
   /^\/api\/providers\/[^/]+\/refresh-cursor\/?$/, // spawns cursor-agent via renewal.ts (Hard Rules #15 + #17)
   /^\/api\/providers\/cursor\/agent-availability\/?$/, // static path (no dynamic segment), but kept in this array alongside its /api/providers/ siblings rather than the flat SPAWN_CAPABLE_PREFIXES array — spawns cursor-agent status via checkCursorAgentAvailability()/getCachedCursorAgentAvailability() (Hard Rules #15 + #17)
+  /^\/api\/providers\/[^/]+\/chatgpt-web-codex-doctor\/?$/, // spawns via getTunnelRuntimeStatus() → spawnSync("...","runtimes status") (open-sse/executors/chatgpt-web-codex/tunnelClient.ts). Mirrors LOCAL_ONLY_API_PATTERNS in routeGuard.ts; keep the two in sync (GHSA-9q3h-mjm5-f4gj).
 ];
 
 /**