Harden the local bridge: pin Host, write tabs.json 0600

[colevels]

Two gaps in the security model tabs serve documents. Both found reviewing #22; split out of #23 so the restructure stayed reviewable.

1. tabs.json was world-readable

tabs.json         -rw-r--r--     ← before
credentials.json  -rw-------

Same directory, different permissions. tabs.json is written through the shared atomicWrite, whose other caller is init — where 0644 is correct — so it inherited the umask default.

That file is the URL and title of every open tab. It's worse to leak than the token in the next file over: a token is revocable, browsing history isn't, and full URLs carry more than hostnames (account paths, doc links, share links with tokens in the query string).

I checked whether the directory saved us. It doesn't — ~/.config/tabbrew is drwxr-xr-x in practice, not the 0700 the code intends, so the file mode was the only protection and it wasn't set. Worse with --out ./tabs.json into a repo folder, where it's also a git add away from being committed.

atomicWrite now takes an optional mode, applied to the temp file at creation so the content is never briefly readable at 0644. Because rename makes that temp inode become the target, the mode survives even over a pre-existing looser file — no follow-up chmod needed, unlike the non-atomic write in credentials.ts. init's files are untouched (verified below).

2. The Origin check didn't stop DNS rebinding

The header the check relies on isn't sent in the case that matters:

1. Victim opens http://evil.com; attacker's DNS has a short TTL
2. Page polls http://evil.com:49227/script
3. Attacker flips DNS to 127.0.0.1
4. Request hits this server — but the page's origin is still http://evil.com, so the browser treats it as same-origin
5. Per the Fetch spec, Origin is omitted on same-origin GET/HEAD → the check waves it through
6. Same-origin ⇒ no CORS ⇒ the page reads the response

It gets the queued script and, because GET /script has pop semantics, denies it to the real extension. Confirmed by hand before the fix:

$ curl -H 'Host: evil.example' http://127.0.0.1:49302/script
{"script":"DEL 999","queuedAt":"..."}   [200]

Now Host must be 127.0.0.1:<port> or localhost:<port>. The browser sets Host from the URL the page asked for (evil.com:49227) and page JS can't forge it — Host is a forbidden header name. Extension traffic addresses 127.0.0.1 directly and is unaffected.

The Origin check stays. Browsers always attach Origin to non-GET requests, so it's what blocks a drive-by POST /tabs from writing to disk — a page can do that with Content-Type: text/plain to dodge preflight. The two checks cover different halves.

Severity, honestly

Neither is urgent. The rebinding payload is a list of tab ids and group names that exists for seconds, and needs the victim on the attacker's page at exactly the right moment. The file mode matters mainly on shared machines, CI runners, and synced home directories. But the README now states a security model, and a stated model should be complete — both fixes are a handful of lines.

Test plan

• bun run typecheck, bun run build
• tabs.json is now -rw-------
• Host: evil.example → 403 forbidden_host on both /script and /health
• 127.0.0.1 and localhost still 200 — the bridge isn't broken
• POST /tabs with a foreign Origin still 403 (no regression on the check being kept)
• serve + push round-trip still works end to end
• Regression: init still writes CLAUDE.md / TABBREW-CLI.md / SKILL.md at 0644

🤖 Generated with Claude Code