8000 docs(threat-model): news feed sources as an entry point by adeelahmad · Pull Request #522 · adeelahmad/lense · GitHub
[go: up one dir, main page]
Skip to content

docs(threat-model): news feed sources as an entry point #522

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
adeelahmad merged 4 commits into from
Oct 17, 2026
Merged

docs(threat-model): news feed sources as an entry point #522

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
8dddcee
docs(threat-model): news feed sources as an entry point
claude Oct 17, 2026
3d6838c
Merge remote-tracking branch 'origin/main' into tm522
claude Oct 17, 2026
8b2ff14
Merge remote-tracking branch 'origin/main' into tm522
claude Oct 17, 2026
59a2cb1
Merge remote-tracking branch 'origin/main' into tm522
claude Oct 17, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
32 changes: 21 additions & 11 deletions threat-model.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@
"scope_subpath": null,
"description": "Lens is a self-hosted archive for documents, recordings, photos and messages: it reads, transcribes, indexes and publishes them, and people search and chat over them. One operator (the instance admin) runs an instance for their own people: a FastAPI API, a Next.js web app that proxies the API and holds the sign-in session, and background workers, around one SurrealDB database, with content split into namespaces and per-namespace roles. Exposing an instance to the internet behind HTTPS (reverse proxy or Cloudflare tunnel) is supported. Only the instance admin (equivalent to host code execution) and the host operator are trusted; everyone else is trusted only as far as their role.",
"confidence": {
"documented": 250,
"documented": 251,
"inferred": 99
},
"components": [
Expand Down Expand Up @@ -66,11 +66,12 @@
{
"name": "outbound",
"entry_points": [
"watched folders, storage sources, IMAP, Gmail, iCal",
"watched folders, storage sources, IMAP, Gmail, iCal, news feeds",
"Google Calendar sources",
"News feed sources",
"Connect with Google",
"POST /imports/web, extension http tools, notification targets",
"admin settings (model, embeddings, speech, decisions, Fedora, bridge, telemetry, IIIF import, rclone remotes, IMAP, Gmail sign-in, iCal, MQTT bridge, OIDC issuer, web search)",
"admin settings (model, embeddings, speech, decisions, Fedora, bridge, telemetry, IIIF import, rclone remotes, IMAP, Gmail sign-in, iCal, news feeds, MQTT bridge, OIDC issuer, web search)",
"replies from remote servers",
".env, archive.yaml, LENS_*, ARCHIVE_SECRET_KEY, RCLONE_BINARY"
],
Expand Down Expand Up @@ -188,7 +189,7 @@
},
{
"component": "outbound",
"boundary": "B4, Lens to the outside: fetches whose URL a non-admin sets, and iCal feeds, go through netguard; other admin-set URLs do not; the telemetry endpoint is only shape-checked (P-ADMIN-GUARD).",
"boundary": "B4, Lens to the outside: fetches whose URL a non-admin sets, and iCal and news feeds, go through netguard; other admin-set URLs do not; the telemetry endpoint is only shape-checked (P-ADMIN-GUARD).",
"provenance": "inferred",
"reachability_precondition": "a URL a non-admin sets, or a guarded admin operand, reaches a non-public address; or a stored secret reaches anyone but the host the admin set",
"source": "threat-model.md §1.4 (untagged boundary list)"
Expand Down Expand Up @@ -413,8 +414,8 @@
"source": "docs/api.md \"the address form takes hook tokens only\""
},
{
"entry_point": "watched folders, storage sources, IMAP, Gmail, iCal",
"parameter": "remote file names, bytes, mail, events",
"entry_point": "watched folders, storage sources, IMAP, Gmail, iCal, news feeds",
"parameter": "remote file names, bytes, mail, events, feed posts",
"attacker_controllable": "yes",
"component": "outbound",
"caller_must_enforce": "admin creates sources",
Expand All @@ -430,6 +431,15 @@
"provenance": "documented",
"source": "docs/processing.md \"The token endpoint is always Google's own\""
},
{
"entry_point": "News feed sources",
"parameter": "the feed's address (or a site's page that names its feed), user and password; the feed's XML and its posts' HTML",
"attacker_controllable": "yes",
"component": "outbound",
"caller_must_enforce": "admin creates sources; fetched as iCal feeds are; feedparser reads the XML with external entities off and drops scripts, styles and event handlers from a post's HTML; each post kept as an Atom entry Lens writes, without the feed's address; post text is marked untrusted in prompts",
"provenance": "documented",
"source": "docs/processing.md \"News feeds (RSS and Atom)\""
},
{
"entry_point": "Connect with Google",
"parameter": "OAuth client id and secret; on the way back state, code and the email in Google's id token",
Expand Down Expand Up @@ -458,7 +468,7 @@
"source": "docs/assistant.md \"a search or a page read sends words out of Lens\""
},
{
"entry_point": "admin settings (model, embeddings, speech, decisions, Fedora, bridge, telemetry, IIIF import, rclone remotes, IMAP, Gmail sign-in, iCal, MQTT bridge, OIDC issuer, web search)",
"entry_point": "admin settings (model, embeddings, speech, decisions, Fedora, bridge, telemetry, IIIF import, rclone remotes, IMAP, Gmail sign-in, iCal, news feeds, MQTT bridge, OIDC issuer, web search)",
"parameter": "URL, credentials, api_key_env",
"attacker_controllable": "no",
"component": "outbound",
Expand Down Expand Up @@ -1077,7 +1087,7 @@
"property": "P-SECRETS",
"violation_symptom": "info-leak",
"severity_tier": "security",
"conditions": "stored secrets (source credentials, notification secrets, model API keys, iCal addresses, an automation's credential headers, sealed to that automation and the address they were saved for, an MCP server's credential headers and env values, sealed to its extension and the address or command they were saved for) are encrypted and write-only; the API reports whether one is set, never its value; a key from the environment is never shown; they do not leak through the API, logs, exports, or a redirect to another server",
"conditions": "stored secrets (source credentials, notification secrets, model API keys, iCal and news feed addresses, an automation's credential headers, sealed to that automation and the address they were saved for, an MCP server's credential headers and env values, sealed to its extension and the address or command they were saved for) are encrypted and write-only; the API reports whether one is set, never its value; a key from the environment is never shown; they do not leak through the API, logs, exports, or a redirect to another server",
"provenance": "documented",
"source": "SECURITY.md \"stored credentials for sources and model servers leaking\""
},
Expand All @@ -1093,7 +1103,7 @@
"property": "P-ADMIN-GUARD",
"violation_symptom": "info-leak",
"severity_tier": "security",
"conditions": "guards Lens documents on admin-set operands hold: iCal feeds are fetched like web captures (public addresses only and documents.web_networks, ports 80 and 443, the password never goes on to a server the calendar redirects to); the telemetry endpoint cannot carry a user name or password or be a link-local address",
"conditions": "guards Lens documents on admin-set operands hold: iCal and news feeds are fetched like web captures (public addresses only and documents.web_networks, ports 80 and 443, the password never goes on to a server the calendar or feed redirects to, or to a feed a site's page names on another server); the telemetry endpoint cannot carry a user name or password or be a link-local address",
"provenance": "documented",
"source": "docs/processing.md \"fetched the way web pages are captured\""
},
Expand Down Expand Up @@ -1372,7 +1382,7 @@
},
{
"property": "N-EGRESS",
"reason": "an egress firewall; netguard guards web import, iCal feeds, extension http tools, notifications, the assistant's web search and page reads, and Chromium, nothing else; admin-set URLs other than iCal feeds (model, speech, Fedora, IIIF import, rclone sources, IMAP, MQTT bridge, OIDC, telemetry, tunnel, a SearXNG instance for web search) are unguarded",
"reason": "an egress firewall; netguard guards web import, iCal and news feeds, extension http tools, notifications, the assistant's web search and page reads, and Chromium, nothing else; admin-set URLs other than iCal and news feeds (model, speech, Fedora, IIIF import, rclone sources, IMAP, MQTT bridge, OIDC, telemetry, tunnel, a SearXNG instance for web search) are unguarded",
"false_friend": true,
"provenance": "documented",
"source": "maintainer ruling, 2026-10"
Expand Down Expand Up @@ -1742,7 +1752,7 @@
},
{
"pattern": "Wide LENS_WEB_NETWORKS",
"why_unsafe": "Editors, and iCal feed redirects, can then reach those networks",
"why_unsafe": "Editors, and iCal and news feed redirects, can then reach those networks",
"instead": "List single hosts"
},
{
Expand Down
Loading
Loading
0