clawlter/camofox-firecrawl-shim
Watch
1
0
Fork
You've already forked camofox-firecrawl-shim
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

WIP: Enforce outbound destination policy #16

Closed
clawlter wants to merge 1 commit from audit/network-policy into main
pull from: audit/network-policy
merge into: clawlter:main
Conversation 1 Commits 1 Files changed 7 +1024 -7
clawlter commented 2026-07-12 08:20:03 -04:00
Owner
Copy link

Summary

  • enforce a centralized deny-by-default destination policy across scrape, search, map, and crawl
  • force Camofox browser traffic through a local validating proxy, including redirected requests, with DNS answers pinned to outbound connections
  • reject credentials, malformed hosts, mixed/private DNS answers, metadata and other non-public ranges; retain an explicit loopback-only test mode
  • document policy modes, threat boundaries, residual risks, and operator configuration

Verification

  • uv run --offline --with-requirements requirements-dev.txt ruff format --check .
  • uv run --offline --with-requirements requirements-dev.txt ruff check .
  • python3 -m py_compile shim.py network_policy.py ensure_shim.py cron/ensure_camofox_firecrawl_shim.py check_updates.py
  • uv run --offline --with-requirements requirements-dev.txt python -m pytest -q (59 passed)
  • git diff --check

Security notes

The default public mode rejects any hostname unless every resolver answer is globally routable. The proxy revalidates each browser request, connects directly to an approved resolved socket address, and uses a per-navigation probe so Camofox bypasses fail closed. See docs/network-policy-audit.md for the full analysis and residual operational risks.

## Summary - enforce a centralized deny-by-default destination policy across scrape, search, map, and crawl - force Camofox browser traffic through a local validating proxy, including redirected requests, with DNS answers pinned to outbound connections - reject credentials, malformed hosts, mixed/private DNS answers, metadata and other non-public ranges; retain an explicit loopback-only test mode - document policy modes, threat boundaries, residual risks, and operator configuration ## Verification - `uv run --offline --with-requirements requirements-dev.txt ruff format --check .` - `uv run --offline --with-requirements requirements-dev.txt ruff check .` - `python3 -m py_compile shim.py network_policy.py ensure_shim.py cron/ensure_camofox_firecrawl_shim.py check_updates.py` - `uv run --offline --with-requirements requirements-dev.txt python -m pytest -q` (59 passed) - `git diff --check` ## Security notes The default `public` mode rejects any hostname unless every resolver answer is globally routable. The proxy revalidates each browser request, connects directly to an approved resolved socket address, and uses a per-navigation probe so Camofox bypasses fail closed. See `docs/network-policy-audit.md` for the full analysis and residual operational risks.
feat: enforce outbound destination policy
Some checks failed
CI / Validate formatting, linting, and tests (pull_request) Failing after 1m52s
Details
9d138da2e8
clawlter force-pushed audit/network-policy from 9d138da2e8
Some checks failed
CI / Validate formatting, linting, and tests (pull_request) Failing after 1m52s
Details
to 26101c7f48
All checks were successful
CI / Validate formatting, linting, and tests (pull_request) Successful in 1m42s
Details
2026-07-12 08:33:01 -04:00 Compare
clawlter changed title from Enforce outbound destination policy to WIP: Enforce outbound destination policy 2026-07-12 08:39:14 -04:00
clawlter commented 2026-07-14 08:15:22 -04:00
Author
Owner
Copy link

Closing without merge because the owner cancelled the code-security-audit-2026-07 campaign. This does not revert previously merged work.

Closing without merge because the owner cancelled the `code-security-audit-2026-07` campaign. This does not revert previously merged work.
clawlter closed this pull request 2026-07-14 08:15:22 -04:00
All checks were successful
CI / Validate formatting, linting, and tests (pull_request) Successful in 1m42s
Required
Details

Pull request closed

This pull request cannot be reopened because the branch was deleted.
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
clawlter/camofox-firecrawl-shim!16
No description provided.