Dynamic surveys: RCE, SSRF, cross-tenant cache, and unvalidated launch answers

[krlex]

Closes C1, H1, H2 and M1 from the 2026-08-19 Codex review — every finding in
the dynamic-survey subsystem. Each is demonstrated against the code as it stands
on develop, not argued from reading it.

C1 — Jinja2 rendered arbitrary Python in the web process

_resolve_jinja2 used a plain jinja2.Environment. Jinja seeds every
environment with cycler, joiner, lipsum and namespace — class instances
whose __init__.__globals__ is Python's module table.

["x", "{{ cycler.__init__.__globals__.os.getcwd() }}"]            -> ['x', '/']
["x", "{{ cycler.__init__.__globals__.os.environ.get('PATH') }}"] -> ['x', '/usr/local/bin:...']

Wrapping the expression in a JSON list is what makes the read observable — bare,
the rendered repr fails json.loads and the caller sees [], so the payload
looks inert while it has already run. Present in main and in every published
tag from v2026.05.0 through v2026.07.2-rc1.

Refused at validation and at resolve, so specs already in the database stop
executing without a migration. SURVEY_DYNAMIC_CHOICES_JINJA2_ENABLED re-enables
it — a settings-file value, deliberately not a registered API setting, so the
surface used to plant a payload cannot switch on its execution. Enabled, it
renders sandboxed with globals cleared and filters reduced: same payloads come
back SecurityError, empty list.

H1 — the API source was an SSRF primitive

url was checked only for being a non-empty string. Against the pre-fix code,
with a server bound to loopback:

http://127.0.0.1:8099/admin -> ['internal-secret-1', 'internal-secret-2']

Destinations are now named by an operator in
SURVEY_DYNAMIC_CHOICES_API_ALLOWLIST, host-exact, empty by default. An
allowlisted name is re-checked after DNS resolution — a listed host answering
169.254.169.254 is refused — while private ranges stay allowed, because an
on-prem CMDB is the ordinary use and naming the host is the trust decision.
HTTPS only, redirects never followed, methods limited to GET/POST, timeout capped
at 30s, response read bounded at 1 MiB.

H2 — the cache key crossed tenants

The key was the variable name plus an MD5 of the config. Two templates with the
same question and different inventories produced the same key, so the first
request filled the cache and the second was served its host names. The key now
covers template, organization and inventory; with no template to scope by,
nothing is cached at all.

M1 — launch never validated the answer

For dynamic questions the validator was literally pass, with a comment saying
values were checked at resolve time. They were not: the resolve endpoint hands
options to the UI and returns. A direct API client could send any extra_var for a
question that presents as a fixed dropdown. Launch now resolves and checks
membership, failing closed — an answer that cannot be validated is not accepted.

The finding behind the findings

The test file covering all of this had never run. It stubs Django through
sys.modules but not django.db, and forail/__init__.py does
from django.db import connection at import — so collection failed before any
test executed. It passed only as a side effect of another module importing first,
which is why CI excluded it as "order-dependent". 37 tests covering every
dynamic_choices source type had not run in CI.

Fixed and back in the matrix. Also: docs/13-dynamic-surveys.md stated the
templates "run in a restricted sandbox (no file I/O)". They did not.

Verified

• tests_standalone/test_dynamic_survey_standalone.py: 96 passed (37 before,
  and none of those actually ran).
• Full standalone matrix, one process per file as CI runs it: 12 files green.
• Ruff on the touched files: 6 findings, all pre-existing; develop has 7.

Pairs with forail-frontend#5, which stops offering the withdrawn source type.

Left open, deliberately

dynamic_choices.headers still stores its values in the survey spec in
plaintext. They now travel only to an operator-named host, but they belong in a
credential — that is a feature, not a fix, and it is called out in the docs.