fix(web): require local host, POST-only reload, security headers

Harden --serve/--web against hostile webpages: /api/reload mutated
state on a plain GET, so any page could fire it cross-origin (CSRF /
cheap DoS -- every hit re-parses the sources); it is POST-only now, GET
answers 405 and the page's refresh button posts. On a loopback bind the
Host header must name localhost/127.0.0.1/[::1] (port optional) or the
request is refused with 403, closing DNS rebinding; an explicit --bind
beyond loopback keeps working and already warns. Every response carries
a deny-everything CSP fitting the self-contained page (inline JS/CSS,
data: favicon, same-origin fetches) plus X-Content-Type-Options.

Author: Gheat1

src/opentab/web.py

@@ -279,26 +279,62 @@ def _send(self, status: int, ctype: str, body: bytes) -> None:
         self.send_response(status)
         self.send_header("Content-Type", ctype)
         self.send_header("Content-Length", str(len(body)))
+        # The page is fully self-contained -- inline JS/CSS, a data: favicon, and
+        # fetches only back to this server -- so everything else can be denied.
+        self.send_header(
+            "Content-Security-Policy",
+            "default-src 'none'; script-src 'unsafe-inline'; style-src 'unsafe-inline'; "
+            "img-src data:; connect-src 'self'",
+        )
+        self.send_header("X-Content-Type-Options", "nosniff")
         self.end_headers()
         self.wfile.write(body)
 
     def _send_json(self, data: dict) -> None:
         self._send(200, "application/json; charset=utf-8", json.dumps(data).encode("utf-8"))
 
+    def _check_host(self) -> bool:
+        # DNS-rebinding defense: an attacker's domain can be pointed at 127.0.0.1
+        # and read this server cross-origin, but the Host header still names that
+        # domain -- so on a loopback bind only local names pass. An explicit
+        # --bind beyond loopback opted out (and got the startup warning).
+        if self.server.server_address[0] not in ("127.0.0.1", "::1"):
+            return True
+        raw = (self.headers.get("Host") or "").strip().lower()
+        host = raw[1:].partition("]")[0] if raw.startswith("[") else raw.partition(":")[0]
+        if host in ("localhost", "127.0.0.1", "::1") or raw == "::1":
+            return True
+        self._send(403, "text/plain; charset=utf-8", b"forbidden host")
+        return False
+
     def do_GET(self):
+        if not self._check_host():
+            return
         path = self.path.split("?", 1)[0]
         server: ReportServer = self.server  # type: ignore[assignment]
         if path == "/":
             self._send(200, "text/html; charset=utf-8", server.page().encode("utf-8"))
         elif path == "/api/reload":
-            server.reload()
-            self._send_json({"ok": True})
+            # State-changing, so POST-only: a GET can be fired cross-origin by any
+            # webpage (CSRF), and each reload re-parses the sources off disk.
+            self._send(405, "text/plain; charset=utf-8", b"reload is POST-only")
         elif path.startswith("/api/session/"):
             workflow_id = unquote(path[len("/api/session/") :])
             self._send_json(session_extras(server.app, workflow_id))
         else:
             self._send(404, "text/plain; charset=utf-8", b"not found")
 
+    def do_POST(self):
+        if not self._check_host():
+            return
+        path = self.path.split("?", 1)[0]
+        server: ReportServer = self.server  # type: ignore[assignment]
+        if path == "/api/reload":
+            server.reload()
+            self._send_json({"ok": True})
+        else:
+            self._send(404, "text/plain; charset=utf-8", b"not found")
+
 
 class ReportServer(HTTPServer):
     """Serves the rendered report page plus the per-session JSON extras. The page

src/opentab/webpage.py

@@ -1083,7 +1083,7 @@
   right.appendChild(h('button', { class: 'hbtn', title: 'Model prices (P)', onclick: openPrices }, '$/M prices'));
   right.appendChild(h('button', { class: 'hbtn', title: 'Theme', onclick: openTheme }, '◑ theme'));
   if (META.serve) right.appendChild(h('button', { class: 'hbtn', title: 're-read the data sources',
-    onclick: () => fetch('/api/reload').then(() => location.reload()) }, '↻ refresh'));
+    onclick: () => fetch('/api/reload', { method: 'POST' }).then(() => location.reload()) }, '↻ refresh'));
   const hints = document.getElementById('hints');
   hints.textContent = '';
   [['j/k', 'move'], ['Tab', 'panel'], ['h/l', 'tabs'], ['Esc', 'back'], ['$', 'what-if'], ['p/t', 'projects/time'], ['T', 'trends'], ['P', 'prices'], ['R', 'range']]

test_opentab.py

@@ -8177,6 +8177,51 @@ def test_web_report_server_serves_page_extras_and_404():
     thread.join(timeout=5)
 
 
+def test_web_server_is_hardened_against_csrf_and_dns_rebinding():
+    import threading
+    import urllib.error
+    import urllib.request
+
+    app = app_with([workflow("w1", "2026-05-01 10:00:00")])
+    server = ot.web.ReportServer(("127.0.0.1", 0), app)
+    thread = threading.Thread(target=server.serve_forever, daemon=True)
+    thread.start()
+    port = server.server_address[1]
+    base = f"http://127.0.0.1:{port}"
+    try:
+        # Every response carries the lockdown headers (self-contained page: inline
+        # JS/CSS, data: favicon, fetch back to this server only).
+        resp = urllib.request.urlopen(base + "/")
+        csp = resp.headers["Content-Security-Policy"]
+        assert csp.startswith("default-src 'none'")
+        assert "connect-src 'self'" in csp and "img-src data:" in csp
+        assert resp.headers["X-Content-Type-Options"] == "nosniff"
+        # Reload mutates state, so it is POST-only: a GET (fireable cross-origin
+        # by any webpage) gets a 405 and does not touch the stores.
+        try:
+            urllib.request.urlopen(base + "/api/reload")
+            raise AssertionError("expected a 405")
+        except urllib.error.HTTPError as exc:
+            assert exc.code == 405
+        req = urllib.request.Request(base + "/api/reload", data=b"", method="POST")
+        assert json.loads(urllib.request.urlopen(req).read().decode("utf-8")) == {"ok": True}
+        # DNS rebinding: a foreign Host header is rejected on a loopback bind...
+        req = urllib.request.Request(base + "/", headers={"Host": "evil.example.com"})
+        try:
+            urllib.request.urlopen(req)
+            raise AssertionError("expected a 403")
+        except urllib.error.HTTPError as exc:
+            assert exc.code == 403
+        # ...while every local spelling passes, with or without the port.
+        for host in ("localhost", f"localhost:{port}", "127.0.0.1", f"[::1]:{port}"):
+            req = urllib.request.Request(base + "/", headers={"Host": host})
+            assert urllib.request.urlopen(req).status == 200
+    finally:
+        server.shutdown()
+        server.server_close()
+    thread.join(timeout=5)
+
+
 def test_cli_web_flag_is_recognized_and_is_distinct_from_serve():
     # --web is its own flag; web_command/main route it through the serve path.
     import sys as _sys