Harden local HTTP, Git delivery, and software-update defaults

[ascendedent]

These changes close the local-security issues I opened:

• Loopback HTTP API publishes the action token and does not pin Host #34 Loopback HTTP API publishes the action token and does not pin Host
• Dashboard HTTP responses include user prompt text #35 Dashboard HTTP responses include user prompt text
• Git delivery honors local aliases and hooks in scanned project checkouts #36 Git delivery honors local aliases and hooks in scanned project checkouts
• Software auto-install defaults on without pinning or signing upstream #37 Software auto-install defaults on without pinning or signing upstream
• Quota HTTP client follows redirects while holding provider credentials #38 Quota HTTP client follows redirects while holding provider credentials
• /health returns local filesystem paths #39 /health returns local filesystem paths
• Local dashboard is missing frame-ancestors / X-Frame-Options #40 Local dashboard is missing frame-ancestors / X-Frame-Options
• systemd user unit interpolates the install path without rejecting control characters #41 systemd user unit interpolates the install path without rejecting control characters

What changed

• Every HTTP request now requires a loopback Host (127.0.0.1, localhost, or ::1).
• Responses set Content-Security-Policy: frame-ancestors 'none', X-Frame-Options: DENY, and nosniff.
• Dashboard JSON no longer includes user_message / user_input; the UI no longer renders prompt text.
• Git delivery runs git with aliases and hooks disabled.
• Quota HTTP fails closed on redirects instead of following them with provider credentials.
• Auto-install is off by default and only proceeds when origin is github.com/splunk/token-meter.
• /health still returns page_path for the installer ownership check, but no longer lists page_candidates.
• install-systemd-user rejects control characters, quotes, and similar in the install path.
• New settings files are written 0600.

page_path stays on /health because scripts/install / install-linux use it to confirm the process on :8722 is this runtime.

Fixes #34
Fixes #35
Fixes #36
Fixes #37
Fixes #38
Fixes #39
Fixes #40
Fixes #41

[bhavsarpratik]

Thanks for putting this together and for documenting the security rationale.

We reviewed the current head (5d158e1) and are holding the merge for now. The next revision should:

• keep the action token out of unauthenticated GET responses and close the missing-Origin mutation path without breaking approved native clients;
• replace the absolute /health page_path with an installer-safe ownership signal that does not disclose a local path; and
• send 404 and other error responses through the same security-header path as successful responses.

Once the head is updated, we’ll rerun the security, privacy, and cross-platform checks and get back to you soon.

— Pratik's agent

[ascendedent]

Thanks for the hold notes. Head is now f5a94b7.

• GET /updates/status no longer returns the action token. Native update install still reads the token from GET /menubar; dashboard mutations still use the same-origin state payload. A cookie-only token is a larger follow-up and was not required to keep approved clients working.
• Mutations now reject a remote Origin or Referer. Native companions that omit Origin still work when Host is loopback and the action token is valid. Origin: null is rejected.
• /health reports page_owned / page_ready instead of an absolute page_path.
• send_error (including 404) goes through the same security-header path as _send.

Happy to rerun the security and privacy checks on this head.