Skip to content

Security: salsadigitalauorg/ai_provider_llmd

Security

SECURITY.md

Security Review and Hardening - ai_provider_llmd

Overview

This document outlines the security measures implemented in the ai_provider_llmd module following an OWASP Top 10 2021 security review.

Security Improvements Implemented

Note: This module follows Drupal security best practices by leveraging Drupal's built-in security systems rather than implementing custom solutions. This ensures compatibility, maintainability, and adherence to established security patterns.

1. Server-Side Request Forgery (SSRF) Protection

Location: src/LlmdClient/LlmdClient.php

  • URL Validation: All URLs are validated using filter_var() with FILTER_VALIDATE_URL
  • Protocol Restrictions: Only HTTP and HTTPS protocols are allowed
  • Internal IP Blocking: Requests to private/internal IP ranges are blocked
  • Development Whitelist: Allows localhost, 127.0.0.1, and host.docker.internal for development
  • Endpoint Validation: Only specific API endpoints are allowed

2. Input Validation and Sanitization

Location: src/Plugin/AiProvider/LlmdAiProvider.php, src/LlmdClient/LlmdClient.php

  • Drupal Native Validation: Uses Html::decodeEntities(), Html::escape(), and Unicode::truncate() for text processing
  • Model ID Validation: Restricts model IDs to alphanumeric characters, hyphens, underscores, and dots
  • Length Limits: Uses Drupal's Unicode::truncate() for safe content length enforcement (100KB)
  • Role Validation: Restricts message roles to allowed values (system, user, assistant, function)
  • URL Validation: Uses Drupal's Url::fromUri() for proper URL validation in forms

3. Enhanced Authentication and Authorization

Location: src/Form/LlmdConfigForm.php, src/LlmdClient/LlmdClient.php

  • API Key Validation: Validates API key existence, format, and minimum length
  • Permission Checks: Additional permission verification for connection testing
  • Secure Key Handling: Improved API key retrieval and validation from Drupal's Key module

4. Security Logging and Monitoring

Location: Multiple files

  • Security Event Logging: Logs all connection attempts, API requests, and security events
  • Audit Trail: Tracks user actions and system events for security monitoring
  • Safe Debug Logging: Removes sensitive data from debug logs while maintaining functionality
  • Failed Authentication Logging: Logs failed connection attempts and errors

5. Secure HTTP Configuration

Location: src/LlmdClient/LlmdClient.php

  • SSL Certificate Verification: Enforces SSL certificate validation (verify: TRUE)
  • Security Headers: Adds security headers to API requests
  • Timeout Validation: Restricts timeout values to reasonable ranges (1-300 seconds)

6. Error Handling and Information Disclosure Prevention

Location: Multiple files

  • Generic Error Messages: User-facing error messages don't reveal system details
  • Detailed Security Logging: Internal logs contain details for debugging without exposing to users
  • Exception Handling: Proper exception handling prevents information leakage

Security Configuration Recommendations

Production Deployment

  1. Use HTTPS Only: Configure the orchestrator to use HTTPS endpoints
  2. API Key Security: Use strong, unique API keys stored securely in Drupal's Key module
  3. Network Isolation: Deploy the orchestrator in a separate network segment
  4. Regular Updates: Keep dependencies and the module updated

Monitoring and Alerting

  1. Log Monitoring: Monitor ai_provider_llmd logs for security events
  2. Failed Connection Alerts: Set up alerts for repeated connection failures
  3. Unusual Activity: Monitor for unusual API usage patterns

Key Drupal Permissions

  • administer ai providers: Required for configuration and connection testing
  • Limit this permission to trusted administrative users only

Tested Security Controls

SSRF Protection

  • ✅ Blocks requests to 192.168.1.1, 10.0.0.1, 172.16.0.1
  • ✅ Allows development hosts: localhost, host.docker.internal
  • ✅ Validates URL format and protocols

Input Validation

  • ✅ Uses Drupal's native text processing (Html, Unicode utilities)
  • ✅ Validates model IDs with regex patterns
  • ✅ Enforces length limits using Unicode::truncate()
  • ✅ Validates URLs using Url::fromUri()

Authentication

  • ✅ Validates API key existence and format
  • ✅ Verifies user permissions for sensitive operations
  • ✅ Logs authentication events

Secure Communication

  • ✅ Enforces SSL certificate verification
  • ✅ Adds security headers to requests
  • ✅ Validates timeout parameters

Security Contact

For security-related issues or questions about this module, please follow Drupal's security reporting procedures.

Regular Security Maintenance

  1. Monthly Reviews: Review security logs for anomalies
  2. Dependency Updates: Keep all dependencies current
  3. Configuration Audits: Regularly audit API keys and permissions
  4. Security Testing: Perform periodic security testing

Last Updated: 2025-01-06
Security Review Version: 1.0
Module Version: 1.0.0-dev

There aren’t any published security advisories