fix(security): confine writes, gate ${env.*}, and bind env creds to trusted endpoints

Fixes three privately-reported advisories:

- GHSA-2956-977x-2w3r (Critical): arbitrary file write. Route every
  file-writing module through validate_path_with_env_config() so output is
  confined to FLYTO_SANDBOX_DIR; the caller can no longer supply the base its
  target is checked against. Modules: image.download/convert/resize/crop/
  compress/rotate/watermark/qrcode_generate, document.excel_write/pdf_fill_form/
  word_to_pdf/pdf_to_word, browser.pagination checkpoint.

- GHSA-hr7p-wg7r-hg9m (High): ${env.VAR} interpolation bypassed the env.get
  denylist. New is_env_var_allowed() ties ${env.*} to the same policy as the
  env.get module: deny-by-default, opt-in via FLYTO_ENV_VAR_ALLOWLIST.

- GHSA-qq9q-xgm3-xv9g (High): env-derived API key forwarded to a
  caller-controlled base_url. New assert_env_credential_endpoint_allowed()
  attaches an env key only to the official endpoint or FLYTO_TRUSTED_LLM_HOSTS,
  across llm.chat, ai.model, llm.agent and vector.connector; also adds the
  missing SSRF check to ai.model.

Each fix verified against the reporter's own PoC; positive paths (allowlisted
env vars, in-sandbox writes, trusted endpoints) confirmed still working.

Author: ChesterHsu

src/core/engine/variable_resolver.py

@@ -7,9 +7,12 @@
 """
 import re
 import os
+import logging
 from typing import Any, Dict, List, Optional
 from datetime import datetime
 
+logger = logging.getLogger(__name__)
+
 
 class VariableResolver:
     """
@@ -194,6 +197,19 @@ def _get_variable_value(self, var_path: str) -> Any:
             if len(parts) < 2:
                 return None
             env_var = parts[1]
+            # SECURITY: gate ${env.*} through the same policy as the `env.get`
+            # module so denylisting env.get is not bypassable via interpolation
+            # (GHSA-hr7p-wg7r-hg9m). Deny-by-default; opt in via
+            # FLYTO_ENV_VAR_ALLOWLIST.
+            from core.module_policy import is_env_var_allowed
+            if not is_env_var_allowed(env_var):
+                logger.warning(
+                    "Blocked ${env.%s} interpolation: env access is denied by "
+                    "policy. Allow the env.get module or add %s to "
+                    "FLYTO_ENV_VAR_ALLOWLIST to permit it.",
+                    env_var, env_var,
+                )
+                return None
             return os.getenv(env_var)
 
         # Workflow parameters

src/core/module_policy.py

@@ -108,6 +108,44 @@ def is_allowed(self, module_id: str) -> bool:
 module_filter = ModuleFilter()
 
 
+# ---------------------------------------------------------------------------
+# Environment-variable interpolation policy
+# ---------------------------------------------------------------------------
+#
+# The workflow engine expands ${env.VAR} in step parameters. That is the exact
+# capability the `env.get` module denylist exists to block (reading arbitrary
+# host env vars = secret exfil). Interpolation happens in the engine BEFORE the
+# module chokepoint, so denylisting `env.get` alone does not stop it
+# (GHSA-hr7p-wg7r-hg9m). We therefore gate ${env.*} through one shared policy:
+#
+#   - If `env.get` is permitted by the module filter, env access is enabled and
+#     ${env.VAR} resolves as before.
+#   - Otherwise (the secure default), ${env.VAR} is DENIED unless VAR matches an
+#     explicit allowlist the operator opts into via FLYTO_ENV_VAR_ALLOWLIST
+#     (comma-separated names or fnmatch globs, e.g. "PUBLIC_*,APP_REGION").
+#
+# This makes engine interpolation and module execution enforce the same env
+# policy, deny-by-default.
+
+def _env_var_allowlist() -> List[str]:
+    raw = os.environ.get("FLYTO_ENV_VAR_ALLOWLIST", "")
+    return [p.strip() for p in raw.split(",") if p.strip()]
+
+
+def is_env_var_allowed(name: str) -> bool:
+    """Whether ${env.<name>} interpolation is permitted by policy.
+
+    Ties ${env.*} to the same control as the `env.get` module: if `env.get` is
+    allowed, env access is enabled; otherwise only names explicitly allowlisted
+    via FLYTO_ENV_VAR_ALLOWLIST resolve, and everything else is denied.
+    """
+    if not name:
+        return False
+    if module_filter.is_allowed("env.get"):
+        return True
+    return any(fnmatch.fnmatch(name, pat) for pat in _env_var_allowlist())
+
+
 # ---------------------------------------------------------------------------
 # Per-module capability permissions (a second lock beyond the module allowlist)
 # ---------------------------------------------------------------------------

src/core/modules/atomic/ai/model.py

@@ -12,6 +12,12 @@
 from ...registry import register_module
 from ...schema import compose, field, presets
 from ...types import NodeType, EdgeType, DataType
+from ....utils import (
+    validate_url_with_env_config,
+    SSRFError,
+    assert_env_credential_endpoint_allowed,
+    CredentialEndpointError,
+)
 
 
 @register_module(
@@ -131,7 +137,19 @@ async def ai_model(context: Dict[str, Any]) -> Dict[str, Any]:
     base_url = params.get('base_url')
     max_tokens = params.get('max_tokens', 4096)
 
+    # SECURITY: validate custom base URL for SSRF (was previously unchecked here).
+    if base_url:
+        try:
+            validate_url_with_env_config(base_url)
+        except SSRFError as e:
+            return {
+                'ok': False,
+                'error': str(e),
+                'error_code': 'SSRF_BLOCKED'
+            }
+
     # Get API key from environment if not provided
+    key_from_env = False
     if not api_key:
         env_vars = {
             'openai': 'OPENAI_API_KEY',
@@ -142,6 +160,18 @@ async def ai_model(context: Dict[str, Any]) -> Dict[str, Any]:
         env_var = env_vars.get(provider)
         if env_var:
             api_key = os.getenv(env_var)
+            key_from_env = bool(api_key)
+
+    # SECURITY: never forward the operator's env-derived key to a caller-supplied
+    # endpoint (GHSA-qq9q-xgm3-xv9g).
+    try:
+        assert_env_credential_endpoint_allowed(base_url, key_from_env)
+    except CredentialEndpointError as e:
+        return {
+            'ok': False,
+            'error': str(e),
+            'error_code': 'ENV_KEY_UNTRUSTED_ENDPOINT'
+        }
 
     if not api_key:
         return {

src/core/modules/atomic/browser/pagination.py

@@ -16,6 +16,8 @@
 from ...registry import register_module
 from ...schema import compose, field
 from ...schema.constants import FieldGroup
+from ...errors import ModuleError
+from ....utils import validate_path_with_env_config, PathTraversalError
 
 logger = logging.getLogger(__name__)
 
@@ -321,6 +323,12 @@ async def execute(self) -> Dict[str, Any]:
         resumed = False
 
         if self.checkpoint_path:
+            # SECURITY: confine the checkpoint write to FLYTO_SANDBOX_DIR
+            # (GHSA-2956-977x-2w3r).
+            try:
+                self.checkpoint_path = validate_path_with_env_config(self.checkpoint_path)
+            except PathTraversalError as e:
+                raise ModuleError(str(e), code="PATH_TRAVERSAL")
             from core.browser.checkpoint import PaginationCheckpoint
             checkpoint = PaginationCheckpoint(
                 self.checkpoint_path, self.item_selector, self.mode,

src/core/modules/atomic/document/excel_write.py

@@ -11,6 +11,8 @@
 
 from ...registry import register_module
 from ...schema import compose, presets
+from ...errors import ModuleError
+from ....utils import validate_path_with_env_config, PathTraversalError
 
 
 logger = logging.getLogger(__name__)
@@ -105,6 +107,12 @@ async def excel_write(context: Dict[str, Any]) -> Dict[str, Any]:
     if not data:
         raise ValueError("Data cannot be empty")
 
+    # SECURITY: confine the write to FLYTO_SANDBOX_DIR (GHSA-2956-977x-2w3r).
+    try:
+        path = validate_path_with_env_config(path)
+    except PathTraversalError as e:
+        raise ModuleError(str(e), code="PATH_TRAVERSAL")
+
     Path(os.path.dirname(path)).mkdir(parents=True, exist_ok=True)
 
     wb = openpyxl.Workbook()

src/core/modules/atomic/document/pdf_fill_form.py

@@ -11,6 +11,8 @@
 
 from ...registry import register_module
 from ...schema import compose, presets
+from ...errors import ModuleError
+from ....utils import validate_path_with_env_config, PathTraversalError
 
 
 logger = logging.getLogger(__name__)
@@ -122,6 +124,12 @@ async def pdf_fill_form(context: Dict[str, Any]) -> Dict[str, Any]:
     if not os.path.exists(template_path):
         return {'ok': False, 'error': f'Template file not found: {template_path}'}
 
+    # SECURITY: confine the write to FLYTO_SANDBOX_DIR (GHSA-2956-977x-2w3r).
+    try:
+        output_path = validate_path_with_env_config(output_path)
+    except PathTraversalError as e:
+        raise ModuleError(str(e), code="PATH_TRAVERSAL")
+
     def _do_fill():
         try:
             from pypdf import PdfReader, PdfWriter

src/core/modules/atomic/document/pdf_to_word.py

@@ -10,6 +10,8 @@
 
 from ...registry import register_module
 from ...schema import compose, presets
+from ...errors import ModuleError
+from ....utils import validate_path_with_env_config, PathTraversalError
 
 
 logger = logging.getLogger(__name__)
@@ -107,6 +109,12 @@ async def pdf_to_word(context: Dict[str, Any]) -> Dict[str, Any]:
     preserve_formatting = params.get('preserve_formatting', True)
     output_path = _resolve_pdf_output(params, input_path)
 
+    # SECURITY: confine the write to FLYTO_SANDBOX_DIR (GHSA-2956-977x-2w3r).
+    try:
+        output_path = validate_path_with_env_config(output_path)
+    except PathTraversalError as e:
+        raise ModuleError(str(e), code="PATH_TRAVERSAL")
+
     if not os.path.exists(input_path):
         raise FileNotFoundError(f"PDF file not found: {input_path}")
     _ensure_output_dir(output_path)

src/core/modules/atomic/document/word_to_pdf.py

@@ -11,6 +11,8 @@
 
 from ...registry import register_module
 from ...schema import compose, presets
+from ...errors import ModuleError
+from ....utils import validate_path_with_env_config, PathTraversalError
 
 
 logger = logging.getLogger(__name__)
@@ -94,6 +96,13 @@ async def word_to_pdf(context: Dict[str, Any]) -> Dict[str, Any]:
     method = params.get('method', 'auto')
 
     output_path = _resolve_output_path(params, input_path, '.pdf')
+
+    # SECURITY: confine the write to FLYTO_SANDBOX_DIR (GHSA-2956-977x-2w3r).
+    try:
+        output_path = validate_path_with_env_config(output_path)
+    except PathTraversalError as e:
+        raise ModuleError(str(e), code="PATH_TRAVERSAL")
+
     _validate_input_and_prepare_output(input_path, output_path, 'Word')
 
     success, method_used = await _run_conversion(method, input_path, output_path)

src/core/modules/atomic/image/compress.py

@@ -11,6 +11,8 @@
 
 from ...registry import register_module
 from ...schema import compose, presets
+from ...errors import ModuleError
+from ....utils import validate_path_with_env_config, PathTraversalError
 
 
 logger = logging.getLogger(__name__)
@@ -167,6 +169,12 @@ async def image_compress(context: Dict[str, Any]) -> Dict[str, Any]:
     original_size = os.path.getsize(input_path)
     output_path = _resolve_compress_output(input_path, output_path, output_format)
 
+    # SECURITY: confine the write to FLYTO_SANDBOX_DIR (GHSA-2956-977x-2w3r).
+    try:
+        output_path = validate_path_with_env_config(output_path)
+    except PathTraversalError as e:
+        raise ModuleError(str(e), code="PATH_TRAVERSAL")
+
     def _compress():
         with Image.open(input_path) as img:
             if img.mode in ('RGBA', 'P') and output_format == 'jpeg':

src/core/modules/atomic/image/convert.py

@@ -11,6 +11,8 @@
 
 from ...registry import register_module
 from ...schema import compose, presets
+from ...errors import ModuleError
+from ....utils import validate_path_with_env_config, PathTraversalError
 
 
 logger = logging.getLogger(__name__)
@@ -53,7 +55,6 @@ def _resolve_convert_paths(input_path: str, output_path: Optional[str], output_f
         base_name = os.path.splitext(input_path)[0]
         extension = SUPPORTED_FORMATS[output_format][0]
         output_path = f"{base_name}{extension}"
-    Path(os.path.dirname(output_path)).mkdir(parents=True, exist_ok=True)
     return output_path, output_format
 
 
@@ -176,6 +177,13 @@ async def image_convert(context: Dict[str, Any]) -> Dict[str, Any]:
 
     output_path, output_format = _resolve_convert_paths(input_path, output_path, output_format)
 
+    # SECURITY: confine the write to FLYTO_SANDBOX_DIR (GHSA-2956-977x-2w3r).
+    try:
+        output_path = validate_path_with_env_config(output_path)
+    except PathTraversalError as e:
+        raise ModuleError(str(e), code="PATH_TRAVERSAL")
+    Path(os.path.dirname(output_path)).mkdir(parents=True, exist_ok=True)
+
     with Image.open(input_path) as img:
         if resize:
             img = _apply_resize(img, resize)