fix(dev): proxy local API and restrict frontend upstream

docker/frontend-entrypoint.sh

@@ -3,13 +3,10 @@ set -eu
 
 THT_FRONTEND_API_UPSTREAM=${THT_FRONTEND_API_UPSTREAM:-http://core:8787}
 THT_FRONTEND_API_UPSTREAM=${THT_FRONTEND_API_UPSTREAM%/}
-case "$THT_FRONTEND_API_UPSTREAM" in
-  http://*|https://*) ;;
-  *)
-    echo "Invalid THT_FRONTEND_API_UPSTREAM: use an internal http(s) upstream" >&2
-    exit 2
-    ;;
-esac
+if ! /usr/local/bin/validate-frontend-api-upstream "$THT_FRONTEND_API_UPSTREAM"; then
+  echo "Invalid THT_FRONTEND_API_UPSTREAM: expected internal http://core:8787" >&2
+  exit 2
+fi
 export THT_FRONTEND_API_UPSTREAM
 
 if ! envsubst '${THT_FRONTEND_API_UPSTREAM}' \

docker/frontend.Dockerfile

@@ -12,6 +12,7 @@ FROM nginxinc/nginx-unprivileged:1.27-alpine AS runtime
 COPY --from=build /src/dist /usr/share/nginx/html
 COPY docker/nginx.conf.template /etc/nginx/templates/default.conf.template
 COPY --chmod=755 docker/frontend-entrypoint.sh /usr/local/bin/frontend-entrypoint
+COPY --chmod=755 docker/validate-frontend-api-upstream.sh /usr/local/bin/validate-frontend-api-upstream
 ENTRYPOINT ["/usr/local/bin/frontend-entrypoint"]
 CMD ["nginx", "-g", "daemon off;"]
 EXPOSE 8080

docker/smoke/frontend-policy-smoke.sh

@@ -31,4 +31,27 @@ if rg -n 'BACKEND_BASE_URL|VITE_BACKEND_URL' docker/frontend-entrypoint.sh docke
   exit 1
 fi
 
+upstream_validator=docker/validate-frontend-api-upstream.sh
+for upstream in http://core:8787 http://core:8787/; do
+  if ! "$upstream_validator" "$upstream"; then
+    echo "frontend upstream validator rejected $upstream" >&2
+    exit 1
+  fi
+done
+
+for upstream in \
+  https://core:8787 \
+  http://core:8080 \
+  http://core:8787/api \
+  http://user:pass@core:8787 \
+  'http://core:8787?next=evil' \
+  'http://core:8787#fragment' \
+  'http://core:8787 injected' \
+  'http://core:8787;proxy_pass http://evil'; do
+  if "$upstream_validator" "$upstream" >/dev/null 2>&1; then
+    echo "frontend upstream validator accepted unsafe upstream: $upstream" >&2
+    exit 1
+  fi
+done
+
 echo "frontend same-origin proxy policy: ok"

docker/validate-frontend-api-upstream.sh

@@ -0,0 +1,7 @@
+#!/bin/sh
+set -eu
+
+case "${1-}" in
+  http://core:8787|http://core:8787/) exit 0 ;;
+  *) exit 2 ;;
+esac