fix(ssrf/browser/http_batch): wrap errors, drop internal IPs (L-7)

The SSRF dial guard's refusal message previously included the resolved
internal IP, leaking an internal-DNS oracle. browser and http_batch also
returned raw network/TLS errors to the model, letting attacker-controlled
x509 SAN text escape the untrusted boundary.

- Drop the resolved IP from the SSRF refusal message.
- Wrap browser fetch errors as untrusted content.
- Wrap http_batch request errors as untrusted content.
- Add regression tests for IP omission and error wrapping.
- Document the change in SECURITY.md and AGENTS.md.

Closes L-7 in sec_findings.md.

Author: jkyberneees

AGENTS.md

@@ -117,6 +117,7 @@ Layered prompt-injection / approval-fatigue defenses. Full reference: [docs/SECU
 - **WebSocket CSRF token** (`cmd/odek/serve.go`) — `odek serve` issues a random 256-bit token at startup and requires it on `/ws` via cookie, `X-Odek-Ws-Token` header, or `odek.<token>` subprotocol. The token is no longer embedded in every `GET /` response; it is only delivered when the request includes the correct `?token=` query parameter (Jupyter-style), and a non-loopback bind prints a loud warning. The localhost origin check remains as defense-in-depth.
 - **SSRF / DNS-rebinding dial guard** (`cmd/odek/ssrf_guard.go` + `internal/danger/classifier.go`) — `browser`, `http_batch`, and `web_search` resolve hostnames at dial time and refuse internal IPs (loopback, RFC1918, RFC4193, link-local, RFC 6598 CGNAT `100.64.0.0/10`, RFC 2544 benchmark `198.18.0.0/15`, and unspecified), then pin the dial to the validated IP. Operator-configured backends (e.g. `web_search.base_url`) are added to an allowlist so container-internal services such as SearXNG remain reachable.
 - **SSRF guard proxy refusal** (`cmd/odek/ssrf_guard.go`) — when `HTTP(S)_PROXY` is set, the transport would dial the proxy instead of the target and the dial guard would only validate the proxy address. `ssrfGuardedTransport` detects an active proxy, logs a warning, and refuses the request so SSRF protection is not silently voided.
+- **SSRF error wrapping** (`cmd/odek/ssrf_guard.go`, `cmd/odek/browser_tool.go`, `cmd/odek/perf_tools.go`) — the SSRF refusal message no longer includes the resolved internal IP, and `browser`/`http_batch` network/TLS errors are wrapped as untrusted content so attacker-controlled text in x509 errors cannot reach the model unwrapped.
 - **REST API CSRF protection** (`cmd/odek/serve.go::requireLocalOrigin`) — state-changing HTTP endpoints (POST/PUT/PATCH/DELETE) require a localhost origin or no Origin header, and static responses set `X-Frame-Options: DENY` + `Content-Security-Policy: frame-ancestors 'none'` to block clickjacking. Every `/api/*` endpoint additionally requires the per-instance `odek_ws_token` (cookie or `X-Odek-Ws-Token` header) and rejects non-loopback `Host` headers, closing DNS-rebinding reads of `/api/sessions`, `/api/resources`, and `/api/models`.
 - **Browser history cap** (`cmd/odek/browser_tool.go`) — navigation history is capped at 50 snapshots to prevent memory DoS from repeated `browser_navigate` calls.
 - **Browser element cap** (`cmd/odek/browser_tool.go`) — the number of interactive elements extracted per page is capped at 500 so a hostile page cannot OOM the agent with thousands of links or buttons.

cmd/odek/browser_tool.go

@@ -236,7 +236,10 @@ func (t *browserTool) doNavigate(rawURL string) (string, error) {
 
 	resp, err := t.client.Do(req)
 	if err != nil {
-		return jsonError(fmt.Sprintf("cannot fetch %q: %v", rawURL, err))
+		// Wrap network/TLS errors as untrusted: x509 errors can contain
+		// attacker-controlled SAN text, and dial errors can expose internal IPs.
+		msg := fmt.Sprintf("cannot fetch %q: %v", rawURL, err)
+		return jsonError(wrapUntrusted(t.toolCtx(), rawURL, msg))
 	}
 	defer resp.Body.Close()
 

cmd/odek/browser_tool_test.go

@@ -2,6 +2,7 @@ package main
 
 import (
 	"encoding/json"
+	"fmt"
 	"net/http"
 	"net/http/httptest"
 	"strings"
@@ -452,6 +453,41 @@ func TestBrowser_ExtractsInteractiveElements(t *testing.T) {
 	}
 }
 
+// TestBrowser_Navigate_ErrorWrapped verifies that network/TLS errors from the
+// HTTP client are wrapped as untrusted content so attacker-controlled text
+// (e.g. x509 SANs) cannot reach the model outside the untrusted boundary.
+func TestBrowser_Navigate_ErrorWrapped(t *testing.T) {
+	allow := "allow"
+	b := &browserTool{
+		state:           &browserState{nextRef: 1},
+		dangerousConfig: danger.DangerousConfig{NonInteractive: &allow},
+	}
+	b.client = &http.Client{
+		Transport: roundTripperFunc(func(*http.Request) (*http.Response, error) {
+			return nil, fmt.Errorf("x509: certificate is valid for attacker-controlled.example.com, not example.com")
+		}),
+	}
+
+	result := callJSON(t, b, `{"action":"navigate","url":"https://example.com/"}`)
+	var r struct {
+		Error string `json:"error"`
+	}
+	mustUnmarshal(t, result, &r)
+	if r.Error == "" {
+		t.Fatal("expected error")
+	}
+	if !strings.HasPrefix(r.Error, "<untrusted_content_") {
+		t.Errorf("browser error should be wrapped as untrusted, got: %q", r.Error)
+	}
+}
+
+// roundTripperFunc adapts a function to http.RoundTripper.
+type roundTripperFunc func(*http.Request) (*http.Response, error)
+
+func (f roundTripperFunc) RoundTrip(req *http.Request) (*http.Response, error) {
+	return f(req)
+}
+
 // ── URL Resolution Tests ───────────────────────────────────────────────
 
 func TestResolveURL_RelativeURL(t *testing.T) {

cmd/odek/next_security_vulnerabilities_test.go

@@ -590,6 +590,37 @@ func TestParallelShell_CapsOutputSize(t *testing.T) {
 	}
 }
 
+// ── 6a. http_batch must wrap network/TLS errors as untrusted ─────────────
+
+func TestHTTPBatch_WrapsErrors(t *testing.T) {
+	allow := "allow"
+	tool := &httpBatchTool{
+		dangerousConfig: danger.DangerousConfig{NonInteractive: &allow},
+	}
+	tool.client = &http.Client{
+		Transport: roundTripperFunc(func(*http.Request) (*http.Response, error) {
+			return nil, fmt.Errorf("x509: certificate is valid for attacker.com, not target.com")
+		}),
+	}
+
+	result := callJSON(t, tool, `{"requests":[{"url":"https://target.com/"}]}`)
+	var r struct {
+		Results []struct {
+			Error string `json:"error"`
+		} `json:"results"`
+	}
+	mustUnmarshal(t, result, &r)
+	if len(r.Results) != 1 {
+		t.Fatalf("expected 1 result, got %d", len(r.Results))
+	}
+	if r.Results[0].Error == "" {
+		t.Fatal("expected error")
+	}
+	if !strings.HasPrefix(r.Results[0].Error, "<untrusted_content_") {
+		t.Errorf("http_batch error should be wrapped as untrusted, got: %q", r.Results[0].Error)
+	}
+}
+
 // ── 7. Browser must enforce an HTTP request timeout ──────────────────────
 
 func TestBrowser_NavigateTimeout(t *testing.T) {

cmd/odek/perf_tools.go

@@ -705,7 +705,9 @@ func (t *httpBatchTool) fetchOne(r httpBatchReq) httpBatchEntry {
 
 	resp, err := t.client.Do(httpReq)
 	if err != nil {
-		entry.Error = err.Error()
+		// Wrap network/TLS errors as untrusted so attacker-controlled text in
+		// x509 / dial errors cannot reach the model outside the untrusted boundary.
+		entry.Error = wrapUntrusted(t.toolCtx(), r.URL, err.Error())
 		return entry
 	}
 	defer resp.Body.Close()

cmd/odek/ssrf_guard.go

@@ -87,7 +87,9 @@ func ssrfGuardedDial(base dialFunc, lookup ipLookupFunc, allowedHosts ...string)
 		if !hostAllowed {
 			for _, ipa := range ips {
 				if danger.IsBlockedIP(ipa.IP) {
-					return nil, fmt.Errorf("blocked connection to %q: resolves to internal address %s (possible SSRF / DNS rebinding)", host, ipa.IP)
+					// Do not include the resolved IP in the error: it would leak an
+					// internal DNS oracle to the model/audit log.
+					return nil, fmt.Errorf("blocked connection to %q: resolves to an internal address (possible SSRF / DNS rebinding)", host)
 				}
 			}
 		}

cmd/odek/ssrf_guard_test.go

@@ -55,6 +55,19 @@ func TestSSRFGuardedDial_ImplicitlyInternalDialedDirect(t *testing.T) {
 	}
 }
 
+func TestSSRFGuardedDial_ErrorOmitsInternalIP(t *testing.T) {
+	var dialed []string
+	guard := ssrfGuardedDial(recordingDial(&dialed), stubLookup("10.0.0.1"))
+
+	_, err := guard(context.Background(), "tcp", "evil.example.com:80")
+	if err == nil {
+		t.Fatal("expected refusal")
+	}
+	if strings.Contains(err.Error(), "10.0.0.1") {
+		t.Errorf("error must not leak resolved IP: %v", err)
+	}
+}
+
 func TestSSRFGuardedDial_ExternalResolvingInternalRefused(t *testing.T) {
 	// The SSRF / rebinding core case: a host that presents as external but
 	// resolves to an internal address must be refused, and no dial attempted.

docs/SECURITY.md

@@ -396,6 +396,8 @@ There is no user-facing allowlist config field today; the list is derived from e
 
 When `HTTP(S)_PROXY` is set, the transport would dial the proxy address instead of the target, so the dial-time guard would validate only the proxy and the real target could be an internal/rebound address. `ssrfGuardedTransport` detects an active proxy and refuses the request with a clear error rather than silently disabling SSRF protection. Outbound tool traffic therefore requires direct connections.
 
+The SSRF refusal message no longer includes the resolved internal IP, and network/TLS errors from `browser` and `http_batch` are wrapped as untrusted content before reaching the model. This closes two leak channels: an internal-DNS oracle (the resolved IP) and attacker-controlled text inside x509 certificate errors.
+
 ### 18b. CGNAT and benchmark IP blocking
 
 Go's `net.IP.IsPrivate()` covers RFC1918 and RFC4193 private ranges, but it does not cover RFC 6598 CGNAT (`100.64.0.0/10`) or the RFC 2544 benchmark-testing range (`198.18.0.0/15`). Tailscale and similar overlay networks use `100.64/10` addresses, so an attacker who could steer the agent to `http://100.x.x.x` (or a hostname that rebinding resolves to such an address) could reach unauthenticated internal services that the operator expected to be unreachable from the agent.