fix(security): prod recipe keeps resolve_remote false; fix allowlist docs

[HecFranco]

Summary

• Recipe: resolve_remote: false + when@prod override
• Fix stale docs claiming empty allowlist is permissive
• Note configuring allowlist when enabling remote

Fixes #31

Test plan

• Review docs/code diffs for accuracy
• Confirm no unintended scope beyond this security remediation
• CI green on this branch

Made with Cursor

Summary by CodeRabbit

• Documentation
  • Clarified SSRF protection behavior: an empty remote host allowlist blocks all remote hosts.
  • Documented that remote image resolution requires an explicit host allowlist.
  • Updated security and upgrade guidance with the latest production configuration requirements.

[coderabbitai]

📝 Walkthrough

Walkthrough

The PR updates security documentation for remote image resolution. It states that an empty remote_host_allowlist denies all remote hosts. It also states that enabling images.resolve_remote requires an explicit allowlist.

Changes

Security allowlist guidance

Layer / File(s)	Summary
Document remote host allowlist behavior docs/SECURITY.md, docs/UPGRADING.md	The security guidance, audit residuals, and upgrade notes now state that an empty remote_host_allowlist denies all hosts. They also require an explicit allowlist when images.resolve_remote is enabled.

Estimated code review effort: 1 (Trivial) | ~3 minutes

🚥 Pre-merge checks | ✅ 3 | ❌ 2

❌ Failed checks (2 inconclusive)

Check name	Status	Explanation	Resolution
Linked Issues check	❓ Inconclusive	The documentation changes meet the allowlist requirements, but the relevant Flex recipe file is excluded, so the recipe requirements cannot be verified.	Review .symfony/recipe/nowo-tech/html-to-word-bundle/1.0/config/packages/nowo_html_to_word.yaml to confirm both required resolve_remote settings.
Out of Scope Changes check	❓ Inconclusive	The visible documentation changes are in scope, but the excluded Flex recipe file prevents verification of the complete changeset.	Review the excluded Flex recipe file and confirm that its changes are limited to issue #31 requirements.

✅ Passed checks (3 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies the production recipe change and the documentation fixes for remote image resolution and host allowlists.

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch security/prod-resolve-remote-false

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@docs/SECURITY.md`:
- Line 52: Update the ImageResolver timeout statement in the security
documentation to describe 10 seconds as the default used when no
images.remote_timeout setting is provided, not as an enforced limit. Preserve
the surrounding mitigation guidance and avoid implying a maximum timeout.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: a1797995-44b4-439e-b4e9-f4d6cc9f25f8

📥 Commits

Reviewing files that changed from the base of the PR and between 1f8e6c9 and deed5e2.

⛔ Files ignored due to path filters (1)

• .symfony/recipe/nowo-tech/html-to-word-bundle/1.0/config/packages/nowo_html_to_word.yaml is excluded by none and included by none

📒 Files selected for processing (2)

• docs/SECURITY.md
• docs/UPGRADING.md

[coderabbitai]

🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win

Describe 10 seconds as the default timeout, not a limit.

ImageResolver reads images.remote_timeout and uses 10.0 only when the setting is absent. The code enforces a minimum of 0.1 seconds, but it does not enforce a maximum of 10 seconds. Update this sentence to avoid misleading operators.

Proposed wording

-- HTTP timeouts are limited (10s) in `ImageResolver`.
+- HTTP timeouts default to 10s and can be configured with `images.remote_timeout` in `ImageResolver`.

As per path instructions, user-facing documentation in English under docs/ must not invent features, versions, or commands.

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change

- **Mitigation**: Keep remote resolution **disabled** (recipe default and `when@prod: resolve_remote: false`). `RemoteImageHostPolicy` **denies** remote hosts when `remote_host_allowlist` is empty — configure an explicit allowlist before enabling remote. Terminate outbound traffic at the network layer; prefer base64 or controlled CDN URLs at the application layer. HTTP timeouts are limited (10s) in `ImageResolver`.

- **Mitigation**: Keep remote resolution **disabled** (recipe default and `when@prod: resolve_remote: false`). `RemoteImageHostPolicy` **denies** remote hosts when `remote_host_allowlist` is empty — configure an explicit allowlist before enabling remote. Terminate outbound traffic at the network layer; prefer base64 or controlled CDN URLs at the application layer. HTTP timeouts default to 10s and can be configured with `images.remote_timeout` in `ImageResolver`.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@docs/SECURITY.md` at line 52, Update the ImageResolver timeout statement in
the security documentation to describe 10 seconds as the default used when no
images.remote_timeout setting is provided, not as an enforced limit. Preserve
the surrounding mitigation guidance and avoid implying a maximum timeout.

Source: Path instructions

[github-actions]

@coderabbitai review

[coderabbitai]

⚠️ Action not completed

Already reviewed.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.