fix: next 5 exploitable vulnerabilities (base64 wrapping, browser title/element wrapping + cap, config size cap, resource resolver symlink Lstat)

Author: jkyberneees

AGENTS.md

@@ -91,7 +91,7 @@ System prompt is loaded by priority: `--system` flag > `~/.odek/IDENTITY.md` > c
 ### Security Architecture
 Layered prompt-injection / approval-fatigue defenses. Full reference: [docs/SECURITY.md](docs/SECURITY.md).
 
-- **Untrusted-content wrapper** (`cmd/odek/untrusted.go`) — every tool whose output sources from outside the trust boundary (`browser`, `read_file`, `shell`, `search_files`, `multi_grep`, `transcribe`, `head_tail`, `diff`, `tr`, `sort`, `json_query`, `batch_patch`, `glob`, `file_info`, `tree`, `session_search`, `@-resources`, `--ctx` files, any MCP tool) wraps results in `<untrusted_content_<nonce> source="...">…</untrusted_content_<nonce>>`. Per-call nonce defeats wrapper-escape via literal close tag.
+- **Untrusted-content wrapper** (`cmd/odek/untrusted.go`) — every tool whose output sources from outside the trust boundary (`browser`, `read_file`, `shell`, `search_files`, `multi_grep`, `transcribe`, `head_tail`, `diff`, `tr`, `sort`, `json_query`, `batch_patch`, `glob`, `file_info`, `tree`, `base64` file mode, `session_search`, `@-resources`, `--ctx` files, any MCP tool) wraps results in `<untrusted_content_<nonce> source="...">…</untrusted_content_<nonce>>`. Browser page title and interactive-element text are wrapped in addition to the main content. Per-call nonce defeats wrapper-escape via literal close tag.
 - **Audit log** (`cmd/odek/audit.go` + `internal/session/audit.go`) — every `wrapUntrusted` call records source + content-hash + turn into `<sessions>/audit/<id>.json`. After each turn a divergence heuristic flags `suspicious_divergence=true` when the agent ingested untrusted content AND its tool calls referenced resources the user did not mention. Inspect with `odek audit <session-id>` / `odek audit --list`.
 - **Memory taint** (`internal/memory/provenance.go`) — `EpisodeProvenance` tracks Untrusted/Sources/UserApproved. Tainted episodes are stored but `Search()` filters them out, so a one-shot injection cannot persist via the episode pipeline. User must explicitly promote.
 - **Skill provenance gate** (`internal/skills/loader.go` + `cache.go`) — `Skill.Provenance{Untrusted, Sources, NeedsReview}`. NeedsReview skills pin to Lazy regardless of `auto_load`. `odek skill promote <name>` clears the flag after user review.
@@ -102,6 +102,7 @@ Layered prompt-injection / approval-fatigue defenses. Full reference: [docs/SECU
 - **WS Origin allowlist** (`cmd/odek/serve.go::checkLocalOrigin`) — rejects non-localhost upgrades. Closes CSRF-on-localhost.
 - **REST API CSRF protection** (`cmd/odek/serve.go::requireLocalOrigin`) — state-changing HTTP endpoints (POST/PUT/PATCH/DELETE) require a localhost origin or no Origin header, and static responses set `X-Frame-Options: DENY` + `Content-Security-Policy: frame-ancestors 'none'` to block clickjacking.
 - **Browser history cap** (`cmd/odek/browser_tool.go`) — navigation history is capped at 50 snapshots to prevent memory DoS from repeated `browser_navigate` calls.
+- **Browser element cap** (`cmd/odek/browser_tool.go`) — the number of interactive elements extracted per page is capped at 500 so a hostile page cannot OOM the agent with thousands of links or buttons.
 - **Search result bounds** (`cmd/odek/file_tool.go`, `cmd/odek/perf_tools.go`) — `search_files` and `multi_grep` enforce a max match limit (500) and a total returned-content cap (1 MiB) to avoid unbounded result JSON.
 - **Perf-tool file-size cap** (`cmd/odek/perf_tools.go`) — `diff`, `base64`, `tr`, `sort`, `json_query`, and `batch_patch` reject files larger than 10 MiB to avoid loading multi-gigabyte files into memory.
 - **Shell output cap** (`cmd/odek/shell.go`, `cmd/odek/perf_tools.go`) — `shell` and `parallel_shell` cap captured stdout/stderr at 1 MiB per stream to prevent memory DoS from commands that dump huge files.
@@ -113,7 +114,9 @@ Layered prompt-injection / approval-fatigue defenses. Full reference: [docs/SECU
 - **Sub-agent task-file cap** (`cmd/odek/subagent.go`) — `odek subagent --task <file>` rejects task files larger than 10 MiB before loading them into memory.
 - **session_search hardening** (`cmd/odek/session_search_tool.go`) — the `get` action returns at most the 100 most recent messages and wraps each message content, task, and buffer entry as untrusted; `list`/`search`/`find` also wrap session tasks.
 - **@-resource / --ctx prompt wrapping** (`cmd/odek/refs.go`, `cmd/odek/serve.go`) — content resolved from `@file` references and `--ctx` files is wrapped as untrusted before being inserted into the prompt.
+- **Config file size cap** (`internal/config/loader.go`) — `~/.odek/config.json` and `./odek.json` are rejected if larger than 5 MiB to prevent OOM from a malicious or broken config at startup.
 - **Resource resolver size cap** (`internal/resource/resource.go`) — `@-resource` file loads are capped at 1 MiB to prevent OOM from `@hugefile` references.
+- **Resource resolver symlink hardening** (`internal/resource/resource.go`) — `FileResolver.Search` uses `os.Lstat` (not `os.Stat`) for search-result metadata, so symlinks cannot leak the size of arbitrary targets outside the workspace.
 - **Sub-agent summary cap** (`cmd/odek/subagent_tool.go`) — each sub-agent result included in the `delegate_tasks` summary is truncated to 100 KiB to prevent memory DoS.
 - **Tree path wrapping** (`cmd/odek/perf_tools.go`) — the `tree` tool wraps every filesystem-derived path as untrusted content.
 - **head_tail output cap** (`cmd/odek/perf_tools.go`) — `head_tail` truncates returned lines so total content stays within 1 MiB, preventing multi-file/multi-line memory DoS.

cmd/odek/browser_tool.go

@@ -49,6 +49,11 @@ type browserSnapshot struct {
 // prevent memory DoS from repeated navigate actions.
 const maxBrowserHistory = 50
 
+// maxBrowserElements caps the number of interactive elements extracted from a
+// page to prevent a hostile page from OOMing the agent with thousands of links
+// or buttons.
+const maxBrowserElements = 500
+
 // browserState holds the shared state for one browser session.
 type browserState struct {
 	mu      sync.Mutex
@@ -379,6 +384,9 @@ func parseHTML(html, pageURL string, status int) browserSnapshot {
 
 	// Extract links
 	for _, m := range reLink.FindAllStringSubmatch(html, -1) {
+		if len(elements) >= maxBrowserElements {
+			break
+		}
 		href := strings.TrimSpace(m[1])
 		text := strings.TrimSpace(m[2])
 		if href == "" || text == "" || href == "#" || strings.HasPrefix(href, "javascript:") {
@@ -404,6 +412,9 @@ func parseHTML(html, pageURL string, status int) browserSnapshot {
 
 	// Extract buttons and inputs
 	for _, m := range reButton.FindAllStringSubmatch(html, -1) {
+		if len(elements) >= maxBrowserElements {
+			break
+		}
 		text := strings.TrimSpace(m[1])
 		if text == "" {
 			text = "button"
@@ -419,6 +430,9 @@ func parseHTML(html, pageURL string, status int) browserSnapshot {
 	}
 
 	for _, m := range reInput.FindAllStringSubmatch(html, -1) {
+		if len(elements) >= maxBrowserElements {
+			break
+		}
 		tag := m[0]
 		text := ""
 		if vm := reInputVal.FindStringSubmatch(tag); len(vm) > 1 {
@@ -442,6 +456,12 @@ func parseHTML(html, pageURL string, status int) browserSnapshot {
 	snap.Content = strings.Join(contentParts, "\n")
 	snap.Elements = elements
 
+	// Title and element text come from the page — wrap them as untrusted content.
+	snap.Title = wrapUntrusted(pageURL, snap.Title)
+	for i := range snap.Elements {
+		snap.Elements[i].Text = wrapUntrusted(pageURL, snap.Elements[i].Text)
+	}
+
 	return snap
 }
 

cmd/odek/browser_tool_test.go

@@ -34,8 +34,8 @@ func TestBrowser_Navigate(t *testing.T) {
 	if r.Error != "" {
 		t.Fatalf("navigate error: %s", r.Error)
 	}
-	if r.Title != "Test Page" {
-		t.Errorf("title = %q, want %q", r.Title, "Test Page")
+	if unwrapUntrusted(r.Title) != "Test Page" {
+		t.Errorf("title = %q, want %q", unwrapUntrusted(r.Title), "Test Page")
 	}
 	if !strings.Contains(r.Content, "Hello World") {
 		t.Errorf("content missing 'Hello World': %q", r.Content)

cmd/odek/next_security_vulnerabilities_test.go

@@ -901,6 +901,80 @@ func TestSkillLoader_CapsFileSize(t *testing.T) {
 	}
 }
 
+// ── 26. base64 must wrap file-mode encoded output as untrusted ───────────
+
+func TestBase64_WrapsFileEncodedContent(t *testing.T) {
+	dir := t.TempDir()
+	path := filepath.Join(dir, "secret.txt")
+	os.WriteFile(path, []byte("sensitive data"), 0644)
+
+	tool := &base64Tool{dangerousConfig: danger.DangerousConfig{}}
+	result := callJSON(t, tool, fmt.Sprintf(`{"path":%q}`, path))
+	var r struct {
+		Encoded string `json:"encoded"`
+		Size    int    `json:"size"`
+	}
+	mustUnmarshal(t, result, &r)
+	if r.Size == 0 {
+		t.Fatal("expected size > 0")
+	}
+	if !strings.HasPrefix(r.Encoded, "<untrusted_content_") {
+		t.Fatalf("base64 file output should be wrapped in untrusted_content, got: %q", r.Encoded)
+	}
+}
+
+// ── 27. browser must wrap page title / element text ──────────────────────
+
+func TestBrowser_WrapsTitleAndElementText(t *testing.T) {
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		fmt.Fprint(w, `<html><head><title>Evil Title</title></head><body><a href="/x">click me</a></body></html>`)
+	}))
+	defer srv.Close()
+
+	tool := newBrowserTool(danger.DangerousConfig{})
+	result := callJSON(t, tool, fmt.Sprintf(`{"action":"navigate","url":%q}`, srv.URL))
+	var r struct {
+		Title    string `json:"title"`
+		Elements []struct {
+			Text string `json:"text"`
+			URL  string `json:"url"`
+		} `json:"elements"`
+	}
+	mustUnmarshal(t, result, &r)
+	if !strings.HasPrefix(r.Title, "<untrusted_content_") {
+		t.Fatalf("browser title should be wrapped, got: %q", r.Title)
+	}
+	if len(r.Elements) == 0 {
+		t.Fatal("expected at least one element")
+	}
+	if !strings.HasPrefix(r.Elements[0].Text, "<untrusted_content_") {
+		t.Fatalf("browser element text should be wrapped, got: %q", r.Elements[0].Text)
+	}
+}
+
+// ── 28. browser must cap the number of interactive elements ──────────────
+
+func TestBrowser_CapsElementCount(t *testing.T) {
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Write([]byte("<html><body>"))
+		for i := 0; i < 1500; i++ {
+			fmt.Fprintf(w, `<a href="/p%d">link %d</a>`, i, i)
+		}
+		w.Write([]byte("</body></html>"))
+	}))
+	defer srv.Close()
+
+	tool := newBrowserTool(danger.DangerousConfig{})
+	result := callJSON(t, tool, fmt.Sprintf(`{"action":"navigate","url":%q}`, srv.URL))
+	var r struct {
+		Elements []any `json:"elements"`
+	}
+	mustUnmarshal(t, result, &r)
+	if len(r.Elements) > 1000 {
+		t.Fatalf("browser did not cap element count: got %d", len(r.Elements))
+	}
+}
+
 // ── 25. tree must wrap filesystem-derived paths as untrusted ──────────────
 
 func TestTree_WrapsPaths(t *testing.T) {

cmd/odek/perf_tools.go

@@ -2146,7 +2146,7 @@ func (t *base64Tool) Call(argsJSON string) (result string, err error) {
 		return jsonResult(base64Result{Error: fmt.Sprintf("cannot read %q: %v", args.Path, err)})
 	}
 	encoded := base64.StdEncoding.EncodeToString(data)
-	return jsonResult(base64Result{Encoded: encoded, Size: len(data)})
+	return jsonResult(base64Result{Encoded: wrapUntrusted(args.Path, encoded), Size: len(data)})
 }
 
 // ═════════════════════════════════════════════════════════════════════════

docs/SECURITY.md

@@ -53,7 +53,7 @@ Tools that wrap:
 
 | Tool | Source attribute |
 |---|---|
-| `browser` (navigate / snapshot / back) | the URL |
+| `browser` (navigate / snapshot / back) | the URL; page title and interactive-element text are wrapped too |
 | `read_file` | the absolute path |
 | `search_files`, `multi_grep` | `<path>:<line>` per match |
 | `shell` | `$ <command>` |
@@ -63,6 +63,7 @@ Tools that wrap:
 | `session_search` | `session_search` (whole result — past sessions may be tainted) |
 | `file_info` | `file_info:<path>` (metadata about an external file) |
 | `tree` | `tree:<root>` (directory/file names from the filesystem) |
+| `base64` (file/path mode) | `base64:<path>` (the encoded bytes are wrapped) |
 | any MCP tool | `mcp:<server>:<tool>` |
 
 `session_search` is wrapped because it can surface content from arbitrary past sessions — including sessions that ingested untrusted content. Wrapping its whole output keeps that content from re-entering as trusted instructions and records the retrieval in the audit log, closing a path that otherwise bypassed the memory taint gate (defense 5).
@@ -71,6 +72,8 @@ The MCP wrapper guards a tool's **output**. The server-supplied tool **descripti
 
 The model is instructed (via the default system prompt) to treat the wrapped region as data, not instructions. A model trained on prompt-injection resistance (Claude Sonnet 4.6+ does this well) honours the boundary. Older models or aggressively fine-tuned ones may not.
 
+Two additional boundaries keep filesystem-derived metadata from leaking as "trusted" context. First, the `base64` tool wraps encoded output when reading from a file path, so even transformed filesystem bytes stay inside an untrusted boundary. Second, the `@`-resource resolver (`FileResolver.Search`) uses `os.Lstat` when building search-result metadata, which prevents a symlink inside the workspace from leaking the size (or other `stat` metadata) of an arbitrary target outside it.
+
 ### 3. Danger classifier (shell)
 
 The `shell` tool tokenises commands and classifies each into one of 9 risk classes (`safe`, `local_write`, `system_write`, `destructive`, `network_egress`, `code_execution`, `install`, `unknown`, `blocked`). Per-class policy (allow / prompt / deny) is configurable.
@@ -257,6 +260,10 @@ See [CLI.md — Dangerous Operations](CLI.md#dangerous-operations) for the full
 }
 ```
 
+### 15. Configuration file size cap
+
+`~/.odek/config.json` and `./odek.json` are rejected if they exceed 5 MiB. This prevents a malicious, truncated, or accidentally-generated config file from causing an out-of-memory condition at startup.
+
 ### YOLO mode
 
 ```json

internal/config/loader.go

@@ -30,6 +30,10 @@ import (
 	"github.com/BackendStack21/odek/internal/telegram"
 )
 
+// maxConfigFileBytes caps how large a config file may be before it is rejected.
+// This prevents a malicious or broken config from OOMing startup.
+const maxConfigFileBytes = 5 << 20 // 5 MiB
+
 // ── Types ──────────────────────────────────────────────────────────────
 
 // CLIFlags holds values parsed from the CLI. Zero/nil values mean the
@@ -408,10 +412,18 @@ func loadFile(path string) FileConfig {
 	if path == "" {
 		return FileConfig{}
 	}
-	data, err := os.ReadFile(path)
+	info, err := os.Stat(path)
 	if err != nil {
 		return FileConfig{} // missing or unreadable = empty
 	}
+	if info.Size() > maxConfigFileBytes {
+		fmt.Fprintf(os.Stderr, "odek: warning: config %s: file exceeds maximum size %d bytes — ignoring file\n", path, maxConfigFileBytes)
+		return FileConfig{}
+	}
+	data, err := os.ReadFile(path)
+	if err != nil {
+		return FileConfig{} // unreadable = empty
+	}
 	var cfg FileConfig
 	if err := json.Unmarshal(data, &cfg); err != nil {
 		fmt.Fprintf(os.Stderr, "odek: warning: config %s: invalid JSON — ignoring file: %v\n", path, err)

internal/config/loader_test.go

@@ -3,6 +3,7 @@ package config
 import (
 	"os"
 	"path/filepath"
+	"strings"
 	"testing"
 
 	"github.com/BackendStack21/odek/internal/memory"
@@ -1015,3 +1016,17 @@ func TestLoadConfig_EmbeddingOverrides(t *testing.T) {
 		t.Errorf("explicit skills timeout = %d, want 7 (respected as-is)", cfg.Skills.Embedding.TimeoutSeconds)
 	}
 }
+
+// TestLoadFile_CapsSize verifies that config files larger than maxConfigFileBytes
+// are ignored to prevent OOM from a malicious or broken config file.
+func TestLoadFile_CapsSize(t *testing.T) {
+	dir := t.TempDir()
+	path := filepath.Join(dir, "odek.json")
+	if err := os.WriteFile(path, []byte(strings.Repeat("x", maxConfigFileBytes+1)), 0644); err != nil {
+		t.Fatal(err)
+	}
+	cfg := loadFile(path)
+	if cfg.Model != "" {
+		t.Fatalf("loadFile should reject a huge config file, got Model=%q", cfg.Model)
+	}
+}

internal/resource/resource.go

@@ -229,7 +229,8 @@ func (f *FileResolver) Search(ctx context.Context, query string, limit int) ([]R
 			break
 		}
 		rel, _ := filepath.Rel(f.root, match)
-		info, err := os.Stat(match)
+		// Use Lstat so that symlinks do not leak metadata from their targets.
+		info, err := os.Lstat(match)
 		if err != nil {
 			continue
 		}

internal/resource/resource_test.go

@@ -1,6 +1,7 @@
 package resource
 
 import (
+	"bytes"
 	"context"
 	"fmt"
 	"os"
@@ -649,3 +650,42 @@ func TestSessionResolverLoad_PathTraversal(t *testing.T) {
 		}
 	}
 }
+
+// ── Bug #30: FileResolver.Search follows symlinks via os.Stat ───────────────
+
+func TestFileResolverSearch_DoesNotFollowSymlinksForMetadata(t *testing.T) {
+	dir := t.TempDir()
+	base := filepath.Join(dir, "base")
+	if err := os.MkdirAll(base, 0755); err != nil {
+		t.Fatal(err)
+	}
+
+	secret := filepath.Join(dir, "secret.txt")
+	// 2000 bytes produces "2.0 KB" in Detail if os.Stat follows the symlink.
+	if err := os.WriteFile(secret, bytes.Repeat([]byte("x"), 2000), 0600); err != nil {
+		t.Fatal(err)
+	}
+	link := filepath.Join(base, "leak.txt")
+	if err := os.Symlink(secret, link); err != nil {
+		t.Fatal(err)
+	}
+
+	resolver := NewFileResolver(base)
+	results, err := resolver.Search(context.Background(), "leak", 10)
+	if err != nil {
+		t.Fatalf("Search failed: %v", err)
+	}
+	if len(results) != 1 {
+		t.Fatalf("expected 1 result, got %d", len(results))
+	}
+	res := results[0]
+	// With os.Stat the target's size (2.0 KB) would leak through Detail.
+	// With os.Lstat we get the symlink's own metadata, never the target size.
+	if strings.Contains(res.Detail, "2.0") {
+		t.Errorf("symlink leaked target file size through Detail: %s", res.Detail)
+	}
+	// The returned resource reference must point to the symlink inside the base.
+	if res.ID != "@leak.txt" {
+		t.Errorf("expected resource ID %q, got %q", "@leak.txt", res.ID)
+	}
+}