The /ws_debug debugger WebSocket gated JWT signature verification on inline
`code` being present (`if (code && REQUIRE_SIGNED_REQUESTS)`), so a
`program`-mode launch (naming an arbitrary server-side file path that is read
and executed) skipped verification entirely — even with
REQUIRE_SIGNED_DEBUG_REQUESTS=true. The WS handshake also performed no Origin
check, allowing cross-origin (CSWSH) drive-by from a malicious page.
- Enforce signing on every launch in both handlers (Python + Bun/TS): reject
program-mode outright and require+verify a token for inline code.
- Add opt-in DEBUG_ALLOWED_ORIGINS allowlist enforced at the WS handshake.
- Default docker-compose REQUIRE_SIGNED_DEBUG_REQUESTS to true.
- Update THREAT_MODEL T8/EP15 to reflect the root cause and mitigation.
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Multiple fixes to make nsjail work correctly:
1. Use absolute paths for python3 and bun binaries (/usr/bin/python3,
/usr/bin/bun) since nsjail's execve doesn't use PATH
2. Update cwd to use temp directory when code is written there, so
nsjail can find the script files (was using /debugger as cwd before)
3. Bind-mount /tmp from host instead of using tmpfs, so the temp
directories with scripts are accessible inside the sandbox
4. Add /debugger directory mount so Python debugger server script
is accessible inside nsjail
5. Add PATH environment variable to nsjail config
All debugger tests now pass with ENABLE_NSJAIL=true.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
The public key decoding from JWKS was missing base64url padding, causing
JWT signature verification to fail with "invalid jwt token" errors in
production. The `jwk.x` value needs proper padding before base64 decoding.
Fixed by using the existing `base64urlDecode` helper function which
correctly adds padding, instead of manually doing the conversion.
This resolves JWT verification failures when REQUIRE_SIGNED_DEBUG_REQUESTS
is enabled.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Ruben Fiszel