[SECURITY] Stacked meta-PR: AR SQLi, CRLF headers, open redirect, cookies, CSRF

[thomasklemm]

Stacked compiler/runtime security meta-PR. Includes #459 (limit/offset/hash order), #461 (CRLF Location / disposition / Tep+CGI drop), and #464 (positional where/having binds). Extra commits on top. Roundhouse only (runtime/ruby, lowerer, Spinel glue). No Campfire/base-app patches.

Closes #23.

Landed

• [SECURITY] fix Active Record limit and order SQL injection rubys/roundhouse#459 + extras. limit/offset as integers; hash order allowlist; string order parsed as col/table.col plus optional ASC/DESC; last_n/first_n validate before mutating.
• [SECURITY] Drop CR/LF headers in Spinel servers and strip redirect and disposion CRLF rubys/roundhouse#461 + extras. Shared location sanitizer for redirect_to, head, and render; headers[]= drops illegal lines (HeaderStore); blob filename CR/LF/NUL percent-encoded; disk show re-allowlists disposition; one HttpHeaders helper for Tep and CGI (not Tep-only).
• [Security] Values in raw where/having fragments stay inside their quotes rubys/roundhouse#464. Positional ? binds split once so question marks and backslashes in values stay data.
• Open redirect. redirect_to refuses an absolute URL whose host is not this request’s Host (covers params[:back] and a stored request.url after a spoofed HTTP_HOST).
• Session cookies. Honor httponly: / same_site: / secure:; session and flash cookies get SameSite=Lax and Secure on HTTPS. HMAC-only session store is still a named residual (no AES-GCM CookieStore here).
• CSRF (Reuse untyped view lowering across ingest→lower #23). verify_authenticity_token on shared ActionController::Base; implicit protect_from_forgery on; empty session token matches nothing. Ruby/Spinel overlays still mint per-session tokens. Tests keep allow_forgery_protection = false.

Pinned with tests/emit_and_run.rs overlays plus tests/param_binds.rs / existing Spinel header and cookie tests.

Skipped (own PRs / out of scope)

• ActionText XSS #457
• LIKE escaping #327
• Path-decode #429
• Tep HTTP parser #465–#468
• Campfire app bugs, extra html_escape wrap, unverified mention SGID

Residual risk

• Raw joins(String) fragments and update_all("sql") strings stay trusted developer SQL (Rails-same). Identifier quoting is still regex allowlist, not quote_column_name.
• HMAC-only session: a client can read CSRF/return_to from the cookie on cleartext HTTP; flags mitigate the cookie jar, not payload confidentiality.
• Strict targets that never park Current.controller still render an empty token; implicit verify then fail-closes mutating requests. Ruby/Spinel Campfire is the proven pair.
• Spinel twins of some emit_and_run overlays remain #[ignore] (toolchain).

No /thermos review on this PR.

  

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

_{Comment @coderabbitai help to get the list of available commands.}