moadim 1.7.4

Loop engine for AI agents — routines over REST, MCP, and a built-in web UI
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128

use crate::error::AppError;
use axum::{
    extract::Request,
    http::{header, Method},
    middleware::Next,
    response::{IntoResponse, Response},
};
use std::future::Future;
use std::pin::Pin;

/// Environment variable letting an operator extend [`allowed_hosts`] for a deliberate
/// remote/proxy deployment (comma-separated `host[:port]` entries), documented next to
/// `MOADIM_BIND_ADDR` in the README.
const ALLOWED_HOSTS_ENV: &str = "MOADIM_ALLOWED_HOSTS";

/// Build the allowlist of `Host`/`Origin` values [`host_validation`] trusts: `localhost` and
/// `127.0.0.1`/`[::1]` (with and without the daemon's bound port), the raw bind address itself,
/// and any operator-supplied extras from [`ALLOWED_HOSTS_ENV`].
pub(crate) fn allowed_hosts() -> Vec<String> {
    let bind = crate::cli::bind_addr();
    let port = bind.rsplit_once(':').map(|(_, port)| port);
    let mut hosts = vec![
        "localhost".to_string(),
        "127.0.0.1".to_string(),
        "[::1]".to_string(),
        bind.clone(),
    ];
    if let Some(port) = port {
        hosts.push(format!("localhost:{port}"));
        hosts.push(format!("127.0.0.1:{port}"));
        hosts.push(format!("[::1]:{port}"));
    }
    if let Ok(extra) = std::env::var(ALLOWED_HOSTS_ENV) {
        hosts.extend(
            extra
                .split(',')
                .map(str::trim)
                .filter(|host| !host.is_empty())
                .map(str::to_string),
        );
    }
    hosts
}

/// Extract the `host[:port]` component from an `Origin` header value (`scheme://host[:port]`).
fn origin_host(origin: &str) -> &str {
    origin.split_once("://").map_or(origin, |(_, rest)| rest)
}

/// Future returned by the middleware closure built by [`host_validation`].
type ValidationFuture = Pin<Box<dyn Future<Output = Response> + Send>>;

/// Build a middleware guarding the unauthenticated loopback API against browser-borne
/// cross-origin abuse (issue #266):
///
/// - A request whose `Host` header is not in `allowed` is rejected with `403`. This defeats DNS
///   rebinding: a browser-borne request retargeted at the loopback socket still carries the
///   attacker's domain in `Host`, even though the TCP connection itself lands on `127.0.0.1`.
/// - A state-changing request (`POST`/`PUT`/`PATCH`/`DELETE`) whose `Origin` header names a host
///   not in `allowed` is rejected with `403`, blocking a cross-origin page from driving the
///   destructive API even without rebinding.
///
/// A request carrying **no** `Host`/`Origin` header is let through rather than rejected: every
/// real HTTP client (browsers, `curl`, the `moadim` CLI's own loopback client, the MCP transport)
/// always sends `Host`, so an absent header only happens when a test drives the `Router` directly
/// in-process without a real TCP/HTTP round trip — rejecting that would break the whole in-process
/// test suite for no security benefit. Likewise, a missing `Origin` means a non-browser client,
/// which carries no forgeable origin to check in the first place.
///
/// A `Host`/`Origin` header that **is present** but fails to parse as UTF-8 is rejected with
/// `403`, not silently let through: `HeaderValue::to_str` only rejects non-ASCII bytes, which no
/// legitimate client ever sends in these headers, so a present-but-unparseable value is treated
/// as suspicious rather than being conflated with the benign "no header at all" case above.
pub(crate) fn host_validation(
    allowed: Vec<String>,
) -> impl Fn(Request, Next) -> ValidationFuture + Clone + Send + Sync + 'static {
    move |req: Request, next: Next| {
        let allowed = allowed.clone();
        Box::pin(async move {
            match req.headers().get(header::HOST) {
                None => {}
                Some(value) => match value.to_str() {
                    Err(_) => {
                        return AppError::Forbidden("host header is not valid UTF-8".to_string())
                            .into_response();
                    }
                    Ok(host) => {
                        if !allowed.iter().any(|entry| entry.eq_ignore_ascii_case(host)) {
                            return AppError::Forbidden(format!("host '{host}' is not allowed"))
                                .into_response();
                        }
                    }
                },
            }
            let is_state_changing = matches!(
                *req.method(),
                Method::POST | Method::PUT | Method::PATCH | Method::DELETE
            );
            if is_state_changing {
                match req.headers().get(header::ORIGIN) {
                    None => {}
                    Some(value) => match value.to_str() {
                        Err(_) => {
                            return AppError::Forbidden(
                                "origin header is not valid UTF-8".to_string(),
                            )
                            .into_response();
                        }
                        Ok(origin) => {
                            let host = origin_host(origin);
                            if !allowed.iter().any(|entry| entry.eq_ignore_ascii_case(host)) {
                                return AppError::Forbidden(format!(
                                    "origin '{origin}' is not allowed"
                                ))
                                .into_response();
                            }
                        }
                    },
                }
            }
            next.run(req).await
        })
    }
}

#[cfg(test)]
#[path = "host_validation_tests.rs"]
mod host_validation_tests;