[dhinus]

• renderer: Disable file insertion and raw directives in docutils, as they could be used to leak any file that the renderer can read.
• renderer: Disable docutils config files. A config file must not enable these directives again.
• renderer: Refuse paths outside BASE_PATH and paths that contain a file or directory name that starts with ".". nginx already blocks ".." and these names in URLs, but PAWS users could bypass nginx and call the renderer directly.
• renderer: Apply these checks to the real path of the open file, after symlinks are resolved. A symlink in a user home could be used to leak hidden files of other users or files in the renderer container.
• renderer: Render only regular files, and open them with O_NONBLOCK. A FIFO must not block a renderer worker.
• nbserve: Do not follow symlinks in user homes when nginx serves files. A symlink must not expose hidden files of other users or files in the nbserve container. This also applies to "?format=raw", where nginx opens the file after the renderer check.
• helm: Do not mount the paws-public service account token. nbserve and the renderer do not use the Kubernetes API. The file read bugs above could expose the token. They are now fixed, but this also protects against future ones.
• helm: Mount the user homes read-only in the renderer pod. The renderer does not write files.
• helm: Allow connections to the renderer only from nbserve pods. This stops PAWS users from calling the renderer directly and bypassing nginx, as described in the BASE_PATH bullet above. The renderer now refuses these requests, but this also protects against future bugs.

Assisted-by: Claude Opus 5.5
Bug: T441903

[NdibeRaymond]

LGTM
I don't have write access so can't approve