automaton/tasks/complete/harden-dashboard-security/SPEC.md

Harden Dashboard Security

Goal

Close the security gaps identified by the adversarial audit: missing CORS headers, filesystem-sourced task names that bypass validation, and unbounded content-length handling on POST.

Requirements

R1. Add CORS headers

The dashboard serves no CORS headers. When bound to 0.0.0.0 (documented in __main__.py), any webpage can call the API — including approving/rejecting tasks via POST.

Fix: In DashboardHandler._send_json() and _send_error(), add:

• Access-Control-Allow-Origin: * (or configurable via --cors-origin)
• Access-Control-Allow-Methods: GET, POST, OPTIONS
• Access-Control-Allow-Headers: Content-Type
• Handle OPTIONS preflight requests for the review endpoint

R2. Validate filesystem-sourced task names

discover_tasks() at task.py:248 reads directory names directly from iterdir(). The _validate_task_name regex only applies to API path parsing. A task directory created via mkdir with special characters (e.g., quotes, HTML) will be served to the JS client, which injects names into onclick attributes and innerHTML.

Fix: In discover_tasks(), skip directories whose names contain characters outside [A-Za-z0-9_-]. Log a warning for invalid names.

R3. Add content-length bound check on POST regardless of R2 from wire-dashboard-config

Even if the caching task isn't done yet, add a quick defensive check:

• If Content-Length header > MAX_POST_BODY, return 413
• If Content-Length header is missing or <= 0, return 400

R4. Escape task names in JS HTML injection points

In dashboard.js:renderDetail(), renderTaskCard(), and renderTimeline(), task names are interpolated into HTML. While R2 prevents most dangerous names, defense in depth requires:

• Use escapeHtml() on task.display_name before injection
• Use data-* attributes instead of onclick for review buttons (pass task name via dataset)

R5. Add X-Content-Type-Options: nosniff header

All responses should include X-Content-Type-Options: nosniff to prevent MIME type sniffing.

Acceptance Criteria

• All API responses include Access-Control-Allow-Origin header
• OPTIONS /api/task/{name}/review returns 200 with appropriate CORS headers
• Task directory named task-with'quote is excluded from discover_tasks() output
• Task directory named valid-task-123 is included
• POST with Content-Length: 1000000 returns 413 regardless of caching task status
• escapeHtml() applied to display_name in all JS interpolation points
• Review buttons use data-task attribute instead of inline onclick
• All responses include X-Content-Type-Options: nosniff

Non-Goals

• Not adding authentication (the dashboard is a local single-user tool)
• Not adding HTTPS (out of scope for a dev tool)
• Not rate-limiting (single-user, single-threaded server)