doc: describe REST browser risk as DNS rebinding #36644

The Risks section of doc/REST-interface.md describes the wrong way for a web page to read the REST interface.

It says a page can read the node with <script src="http://127.0.0.1:8332/rest/tx/....json">. A JSON object is not a valid script, so that reads nothing. The server accepts any Host header. A page whose domain name is later made to resolve to 127.0.0.1 (DNS rebinding) can therefore read the interface with same-origin requests. I changed the text to say that. A Host check would also stop this, but it needs a list of allowed names, so I left it out. I checked that a REST request with Host: evil.example gets a 200. I did not run a rebinding page.

This is one of several PRs from a large audit of Bitcoin Core that I did with the help of LLM tools. The audit produced its evidence all at once, which is why the PRs arrive together. I understand each change fully and will answer review questions myself.

<!--e57a25ab6845829454e8d69fc972939a-->

The following sections might be updated with supplementary metadata relevant to reviewers and maintainers.

<!--006a51241073e994b41acfe9ec718e94-->

External sites

• Code coverage & benchmarks: https://corecheck.dev/bitcoin/bitcoin/pulls/36644
• Ralph review <img src=https://review.fish.foo/assets/bitcoin/bitcoin/36644.png alt="Ralph review status"> https://git.fish.foo/bitcoin/bitcoin/pulls/36644#author-ralph

<!--021abf342d371248e50ceaed478a90ca-->

Reviews

See the guideline and AI policy for information on the review process. A summary of reviews will appear here.

<!--5faf32d7da4f0f540f40219e4f7537a3-->

<!--85328a0da195eb286784d51f73fa0af9-->

🚧 At least one of the CI tasks failed. _{Task 32 bit ARM: https://github.com/bitcoin/bitcoin/actions/runs/40072166480/job/120807764314} _{LLM reason (✨ experimental): CI failed because CTest tried to execute ARM cross-compiled test binaries on the host, producing shell syntax errors in four tests.}

<details><summary>Hints</summary>

Try to run the tests locally, according to the documentation. However, a CI failure may still happen due to a number of reasons, for example:

• Possibly due to a silent merge conflict (the changes in this pull request being incompatible with the current code in the target branch). If so, make sure to rebase on the latest commit of the target branch.

• A sanitizer issue, which can only be found by compiling with the sanitizer and running the affected test.

• An intermittent issue.

Leave a comment here, if you need help tracking down a confusing failure.

</details>

This seems fine to me as is: It is just a rough example to drive home a point.

Agree. I don't think there's a point in specializing the description here. There are likely multiple issues with running your nodes with REST on the same host as your browser.