Repository navigation
fix(policies): restrict http.send to remote endpoints in restrictive mode - #3586
Merged
Merged
Conversation
…mode In restrictive mode, the Rego engine now rejects http.send requests that use TLS options that load certificates or keys from local files or environment variables, and requests whose URL scheme is not http or https. Inline TLS material is still accepted. Permissive mode is unchanged. Assisted-by: Claude Code Signed-off-by: Miguel Martinez Trivino <miguel@chainloop.dev> Chainloop-Trace-Sessions: 7f271228-5972-4af9-a75f-a912318a4bf5
Contributor
PR validation — ✅ 3 passing
AI Session Checks — 🟢 90% · ✅ 0 failing
|
| Status | Attribution | File | Lines |
|---|---|---|---|
| created | ai | pkg/policies/engine/rego/httpsend_test.go |
+157 / -0 |
| created | ai | pkg/policies/engine/rego/httpsend.go |
+89 / -0 |
| modified | ai | pkg/policies/engine/rego/rego.go |
+11 / -0 |
Policies (4)
| Status | Policy | Material | Messages |
|---|---|---|---|
| ✅ Passed | ai-config-ai-agents-allowed |
ai-coding-session-7f2712 |
- |
| ✅ Passed | ai-config-no-dangerous-commands |
ai-coding-session-7f2712 |
- |
| ✅ Passed | ai-config-no-secrets |
ai-coding-session-7f2712 |
- |
| ✅ Passed | ai-config-mcp-servers-allowed |
ai-coding-session-7f2712 |
- |
Security Checks — ✅ 5 passing
✅ secret-scan
| Status | Policy | Messages |
|---|---|---|
| ✅ Passed | secrets-detection |
- |
✅ sast-scan
| Status | Policy | Messages |
|---|---|---|
| ✅ Passed | owasp-top10-2025 |
- |
| ✅ Passed | sast |
- |
| ✅ Passed | cwe-top25 |
- |
| ✅ Passed | cwe-top26-40-cusp |
- |
Scans not applied (3)
| Scan | Reason |
|---|---|
vulnerability-scan |
no manifest/lockfile changed |
github-actions-scan |
no workflow files changed |
iac-scan |
no IaC files changed |
Security context
This change touches code with 4 recorded security-fix advisories. These are pointers to what past fixes established, not findings in this diff, and they never fail the check.
View in Chainloop ↗ · How this works ↗
Powered by Chainloop and Chainloop Trace
migmartri
marked this pull request as ready for review
October 9, 2026 11:15
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
javirln
approved these changes
Oct 9, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
In restrictive mode, the Rego policy engine now limits
http.sendto plain remote HTTP(S) requests:tls_ca_cert_file,tls_ca_cert_env_variable,tls_client_cert_file,tls_client_cert_env_variable,tls_client_key_file,tls_client_key_env_variable) are rejected. Inline TLS material (tls_ca_cert,tls_client_cert,tls_client_key) is still accepted.httporhttpsare rejected.The check runs on the request object at evaluation time, so it also covers requests built dynamically. It applies to both the CLI and the control plane.
OPA resolves built-ins from a process-wide registry, so
http.sendis wrapped there. The wrapper fails closed: any OPA evaluation in a binary that imports this package gets the restriction, unless it runs through anEnginein permissive mode, which is unchanged.Tested with table-driven tests that cover each option, keys built at runtime, the URL scheme, the
matches_parameterspath, and permissive mode.This change was produced with AI assistance (Claude Code).
🤖 Posted by Maximus bot (Claude Code) on behalf of @migmartri using the eng-autopilot skill