security: hardening pass (30 fixes from Bandit/Semgrep + CodeQL triage)

[HaraldeRoessler]

Summary

Security hardening pass from three layered audits — Bandit + Semgrep (two reviewer sessions) plus GitHub CodeQL default-setup on the fork which surfaced 18 additional findings + caught one I'd missed on re-scan. 30 security fixes plus infrastructure to verify them.

The branch is divided into commits by concern so they're individually revertable:

Commit	Theme	Files	LOC
89bec1d	Mechanical security fixes, no migration	17	+113/−52
8626e14	Fail-fast env vars + hash hardening + scrub_secrets + CSP	4	+174/−29
d25e70c	Critical SSRF block (CodeQL py/full-ssrf)	1	+100/0
3d1b5aa	CodeQL triage (5 real fixes + 4 false-positive dismissals)	4	+30/−9
240e690	CI: fork-level GitHub Actions workflow	1	+138/0
87b69b4	Build: declare pre-existing runtime deps	1	+6/0
f1b9d82	Build: declare email-validator for Pydantic EmailStr	1	+2/0
04f101c	Security: sanitise update_last_seen / update_last_active logs (sibling of fix #25)	1	+6/−2

Total: 8 commits, +569/−90, 22 files.

✅ CI status — green (5/5 jobs)

The branch carries its own CI workflow (commit 240e690). Running on every push to the fork:

Job	Result	Catches
syntax (compileall)	✓	Any .py file that fails to byte-compile
import smoke test	✓	from app.main import app with all required env vars set — proves the fail-fast checks (NONCE_SECRET, MOLTRUST_ADMIN_USERS, etc.) work as intended without crashing the app for legitimate operators
pytest --collect-only	✓	ImportError / SyntaxError in test modules
ruff (informational)	✓	No new lint regressions
bandit SAST (informational)	✓	No new bandit findings

Latest run on 04f101c: https://github.com/HaraldeRoessler/moltrust-api/actions

What the CI surfaced that 4 prior audit passes missed

Running CI uncovered three pre-existing upstream dependency bugs — modules import-ed at top level but not declared in requirements.txt:

• stripe (app/billing.py:21)
• bcrypt (app/admin_auth.py:6)
• email-validator (required for Pydantic EmailStr in billing.CheckoutRequest)

Production clearly has these installed (otherwise the API wouldn't start), but pip install -r requirements.txt on a fresh checkout would crash at module load. Fixed in commits 87b69b4 + f1b9d82. These are not security fixes — separate commits so they can be reverted independently if you prefer to land them as their own PR.

All 30 security fixes (commits 1–4 + 8)

Commit 1 — mechanical, no migration (10)

#	Severity	Fix
1	Critical	Timing-safe secrets.compare_digest for admin keys (15 sites)
2	Critical	Admin bcrypt hashes → MOLTRUST_ADMIN_USERS env (breaking — see migration)
3	Critical	Dockerfile non-root appuser
4	High	MD5 → SHA-256 in news/moltbook dedup
5	High	defusedxml for untrusted RSS feeds
6	High	Dev CORS ["*"] → explicit allowlist
7	High	requests timeouts (7 sites)
8	High	URL scheme validation before urlopen (6 sites)
9	Medium	Swagger UI JS: @5.17.14 + SRI sha384
10	Medium	http://ip-api.com → https://

Commit 2 — fail-fast + deeper hardening (13)

#	Severity	Fix
11	Medium	ipaddress.ip_address() validation on /admin/traffic/caller/{ip}
12	Low	random.choice annotations with security justification (4 sites)
13	Medium	DB_URL cleaned of $(cat /dev/null) antipattern
14	High	MOLTBOOK_APP_KEY "PENDING" → empty + 503-when-unset (low migration risk)
15	Low	GITHUB_CLIENT_ID "PENDING" sentinel removed
16	High	_reg_tracker 64-bit hash → full SHA-256
17	High	scrub_secrets: GitHub / Stripe / OpenAI / JWT / AWS patterns
18	Medium	NONCE_SECRET empty default → raise at startup (breaking)
19	Medium	MOLTSTACK_DB_PW empty default → raise at startup (breaking)
20	Medium	KMS plaintext fallbacks gated by MOLTRUST_ENV=production
21	Medium	update_last_seen / update_last_active: bare except → logger.warning (sanitisation added later in #30)
22	Medium	_get_client_ip trusts X-F-F only from MOLTRUST_TRUSTED_PROXIES CIDRs (breaking if LB is public-IP)
23	Low	CSP header on /docs + SRI on Swagger CSS

Commit 3 — critical SSRF (1)

#	Severity	Fix
24	Critical	_resolve_did_web_external: refuses did:web hosts that resolve to private / loopback / link-local / cloud-metadata IPs. CodeQL py/full-ssrf.

Commit 4 — CodeQL triage (5)

#	Severity	Fix
25	High	credit_middleware logger.error sanitised — type(e).__name__ instead of raw exception (DB conn string with password could appear in repr(e))
26	Medium	/join?ref=… percent-encodes the ref value before interpolating into the redirect URL
27	High	telegram_hn_remind.py prints status only, never response body (bot token in URL could leak)
28	High	packages/mpp/index.js Authorization-header regex: 8 KiB cap + bounded whitespace (ReDoS)
29	High	moltrust-openclaw-v2/src/client.ts trailing-slash trim: loop instead of /+$/ regex (ReDoS)

Commit 8 — CodeQL re-scan follow-up (1)

#	Severity	Fix
30	High	update_last_seen / update_last_active: also sanitise logger.warning(... e) to type(e).__name__ (sibling of #25; missed on round 4). Caught by CodeQL re-scan after merging the security branch into fork main.

⚠️ Operator migration (one-time, before merging)

Five env vars are now refused-when-empty (fail-closed-safer). Setting them:

# Already in your existing prod env (these aren't new requirements):
MOLTRUST_API_KEYS="..."
ADMIN_KEY="..."

# Newly required (or app refuses to start):
MOLTRUST_ADMIN_USERS="lars:superadmin:$2b$12$rxHaim...,harald:admin:$2b$12$c5Gz...,bernd:admin:$2b$12$l3Iu..."
NONCE_SECRET="<any high-entropy string>"
MOLTSTACK_DB_PW="<the existing DB password>"

# Optional (endpoints return 503 when unset):
MOLTBOOK_APP_KEY="..."
GITHUB_CLIENT_ID="..."
GITHUB_CLIENT_SECRET="..."

# Only override if your load balancer uses a public IP:
MOLTRUST_TRUSTED_PROXIES="..."   # default: RFC1918 + loopback + ULA
                                  # use "0.0.0.0/0,::/0" to revert behaviour

# To enable strict mode on KMS signer:
MOLTRUST_ENV="production"        # disables plaintext key fallbacks

The existing bcrypt hashes for MOLTRUST_ADMIN_USERS are recoverable from any commit before 89bec1d on this branch.

CodeQL false positives dismissed on the fork (no code change)

10 alerts dismissed with justification comments visible in the GitHub Security UI:

Rule	Why dismissed
py/clear-text-logging-sensitive-data (×5)	SPIFFE bind logs did/spiffe_uri, _reg_tracker flow uses public DIDs, sites already sanitised via type(e).__name__. CodeQL's name-similarity heuristic ("did" → "id" → "password") misfires.
py/weak-sensitive-data-hashing (×2)	_reg_tracker is in-memory rate-limit bucket-key derivation, not password storage. bcrypt would be wrong.
py/full-ssrf (×1)	Runtime guard _assert_public_host runs before httpx.get and rejects private/loopback/cloud-metadata. CodeQL's taint analysis cannot model that the guard raises.
py/url-redirection (×1)	urllib.parse.quote(ref, safe='') percent-encodes user input; host is hardcoded to moltrust.ch. CodeQL doesn't recognise quote() as a sanitiser.
Other (×1)	Telegram bot token in URL never reaches a logger (only requests.post).

Explicitly deferred (separate PRs / your call)

Item	Why skipped
7× py/stack-trace-exposure in app/main.py + test_harness/routes.py	API contract change — endpoints currently return {"error": str(e)[:100]} and clients may parse the field. Operator-debuggability trade-off; needs your design decision.
SESSIONS dict cleanup in app/admin_auth.py	Needs design (TTLCache vs background sweep vs Redis)
print() → logger across 15+ sites	Too large to mix into this PR
Foundry subprocess → Python web3	Similar refactor closed in PR #2; deferring to you
subprocess for openssl in /health	Low value, no real exposure
.env.dilithium	Verified never in git history — local-disk only

How to merge cleanly

Three options, in order of preference:

A. Merge as-is — squash or rebase-merge, all 8 commits land. Migration env vars set on the server before/at merge time.

B. Merge without the CI workflow — revert commit 240e690 if you'd rather land PR #14's workflow first. The 7 remaining commits (security + build) are self-sufficient.

C. Pick-and-choose — every commit is independently revertable. Drop any specific fix you don't want by reverting just that commit.

Verification — what's actually been tested

• Python 3.12 AST parse on all touched files (local + CI)
• CI smoke test on the fork — 5/5 jobs green on the latest commit 04f101c, including from app.main import app with placeholder env vars
• SRI hashes computed locally and verified against cdn.jsdelivr.net for both Swagger files
• _assert_public_host (SSRF guard) — 14/14 edge cases pass: public DNS allowed, all 16 banned ranges blocked, IPv6 with/without brackets, mixed-case banned hostnames, port-stripping
• scrub_secrets patterns — 12/12 legitimate response shapes pass through clean, 9/9 real secret formats get scrubbed
• 10 CodeQL false positives explicitly dismissed via API with justification comments
• CodeQL final state on the fork: 7 fixed, 10 dismissed, 7 open (all py/stack-trace-exposure, deliberately deferred) — https://github.com/HaraldeRoessler/moltrust-api/security/code-scanning

🤖 Generated with Claude Code