aspera-cli 4.27.5 → 4.28.0

data/lib/aspera/environment.rb

@@ -8,11 +8,12 @@ require 'singleton'
 require 'openssl'
 require 'open3'
 require 'English'
+require 'io/console'
 require 'shellwords'
 require 'aspera/rainbow'
 using Rainbow
 
-# cspell:words mswin bccwin
+# cspell:words mswin bccwin conhost mintty Cmder
 
 module Aspera
   # detect OS, architecture, and specific stuff
@@ -40,6 +41,19 @@ module Aspera
 
     I18N_VARS = %w(LC_ALL LC_CTYPE LANG).freeze
 
+    # Unicode characters used in messages, and their ASCII equivalent when Unicode is not supported (see `Environment.char`)
+    # Key: hidden secret, hieroglyph: app switcher menu of web apps, bust: user menu of web apps
+    UNICODE_TO_ASCII = {
+      '🔑' => '***',
+      '✓' => 'Y',
+      '✗' => ' ',
+      '→' => '->',
+      '…' => '...',
+      '—' => '-',
+      '𓃑' => '(App switcher)',
+      '👤' => '(User)'
+    }.freeze
+
     # "/" is invalid on both Unix and Windows, other are Windows special characters
     # See: https://learn.microsoft.com/en-us/windows/win32/fileio/naming-a-file
     WINDOWS_FILENAME_INVALID_CHARACTERS = '<>:"/\\|?*'
@@ -205,6 +219,15 @@ module Aspera
         $stdout.tty?
       end
 
+      # @return [Integer, nil] Number of columns of the terminal, or `nil` if not a terminal or unknown
+      def terminal_columns
+        return unless terminal?
+        columns = $stdout.winsize[1]
+        columns.positive? ? columns : nil
+      rescue SystemCallError
+        nil
+      end
+
       # force locale to C so that unicode characters are not used
       def force_terminal_c
         I18N_VARS.each { |var| ENV[var] = 'C' }
@@ -213,29 +236,59 @@ module Aspera
       # Override detection of Unicode support: `true` or `false`, or `nil` for auto-detection
       attr_writer :unicode
 
-      # @return [Boolean] true if we can display Unicode characters
+      # @return [Boolean] true if we can display Unicode characters on stdout
+      def terminal_supports_unicode?
+        return @unicode unless @unicode.nil?
+        terminal? && unicode_environment?
+      end
+
+      # @return [Boolean] true if the locale, or the terminal host on Windows, supports Unicode, whether stdout is a terminal or not
       # Uses Encoding.locale_charmap for OS-independent detection.
-      # Falls back to locale env vars for systems where charmap is not available.
+      # On Windows, also detects terminal hosts that render Unicode whatever the console code page.
+      # Falls back to the locale env var with highest precedence, for locales not installed.
       # https://www.gnu.org/software/libc/manual/html_node/Locale-Categories.html
       # https://pubs.opengroup.org/onlinepubs/7908799/xbd/envvar.html
-      def terminal_supports_unicode?
-        return @unicode unless @unicode.nil?
-        return false unless terminal?
-        locale_charmap_utf8? || I18N_VARS.any? { |var| ENV[var]&.include?('UTF-8') }
+      def unicode_environment?
+        return true if locale_charmap_utf8?
+        return true if instance.os.eql?(OS_WINDOWS) && windows_unicode_terminal?
+        locale = ENV.values_at(*I18N_VARS).find { |value| !value.to_s.empty? }
+        locale&.match?(/UTF-?8/i) || false
+      end
+
+      # @param char    [String]  Unicode character, key of UNICODE_TO_ASCII
+      # @param unicode [Boolean] `true` if Unicode is supported
+      # @return [String] The character, or its ASCII equivalent if Unicode is not supported
+      def char(char, unicode: terminal_supports_unicode?)
+        Aspera.assert(UNICODE_TO_ASCII.key?(char), "No ASCII equivalent for: #{char}", type: Aspera::InternalError)
+        unicode ? char : UNICODE_TO_ASCII[char]
       end
 
       private
 
+      # @return [Boolean] true if the terminal host renders Unicode
+      # Ruby writes to the Windows console with WriteConsoleW (UTF-16): the code page does not matter, the font does.
+      # Legacy conhost may lack glyphs (e.g. check marks), while these hosts render them.
+      def windows_unicode_terminal?
+        # Windows Terminal, VS Code, Git Bash, ConEmu or Cmder, MSYS2 or Cygwin or SSH
+        ENV.key?('WT_SESSION') ||
+          %w[vscode mintty].include?(ENV.fetch('TERM_PROGRAM', nil)) ||
+          ENV.fetch('ConEmuANSI', nil).eql?('ON') ||
+          ENV.fetch('TERM', '').match?(/xterm|256color/)
+      end
+
       # @return [Boolean] true if the locale charmap resolves to UTF-8
       # Unix: nl_langinfo(CODESET) returns "UTF-8"
-      # Windows: GetACP returns "CP65001" which Encoding.find resolves as UTF-8
+      # Windows: console code page (GetConsoleCP), else ANSI code page (GetACP): "CP65001" resolves as UTF-8
       def locale_charmap_utf8?
         Encoding.find(Encoding.locale_charmap) == Encoding::UTF_8
       rescue ArgumentError
         false
       end
     end
-    attr_accessor :url_method, :file_illegal_characters
+    # url_method:      :text or :graphical, how URLs, secrets and files are presented to the user
+    # browser_command: [Array<String>, nil] command (and arguments) that opens a URL (URL is appended), instead of
+    #                  the system default
+    attr_accessor :url_method, :browser_command, :file_illegal_characters
     attr_reader :os, :cpu, :default_gui_mode
 
     def initialize
@@ -279,6 +332,7 @@ module Aspera
           :text
         end
       @url_method = @default_gui_mode
+      @browser_command = nil
       @file_illegal_characters = REPLACE_CHARACTER + WINDOWS_FILENAME_INVALID_CHARACTERS
       nil
     end
@@ -327,15 +381,20 @@ module Aspera
       @default_gui_mode == :graphical
     end
 
-    # Open a URI in the system's default graphical browser (non-blocking)
+    # Open a URI in the browser (non-blocking).
+    # The browser is, by priority: `browser_command`, the system default.
     # @param uri [String, URI] the URI to open
     # @return [nil]
     def open_uri_graphical(uri)
-      case @os
-      when Environment::OS_MACOS then self.class.secure_execute('open', uri.to_s)
-      when Environment::OS_WINDOWS then self.class.secure_execute('start', 'explorer', %Q{"#{uri}"})
-      when Environment::OS_LINUX   then self.class.secure_execute('xdg-open', uri.to_s)
-      else Aspera.error_unexpected_value(os) { 'no graphical open method' }
+      if @browser_command
+        self.class.secure_execute(*@browser_command, uri.to_s)
+      else
+        case @os
+        when Environment::OS_MACOS then self.class.secure_execute('open', uri.to_s)
+        when Environment::OS_WINDOWS then self.class.secure_execute('start', 'explorer', %Q{"#{uri}"})
+        when Environment::OS_LINUX   then self.class.secure_execute('xdg-open', uri.to_s)
+        else Aspera.error_unexpected_value(os) { 'no graphical open method' }
+        end
       end
       nil
     end
@@ -352,21 +411,26 @@ module Aspera
     end
 
     # Allows a user to open a URL
+    # if a browser command is defined (`browser_command`), then it is used, whatever the method
     # if method is :text, then URL is displayed on terminal
     # if method is :graphical, then the URL will be opened with the default browser.
     # this is non blocking
     def open_uri(the_url)
-      case @url_method
-      when :graphical
+      if @browser_command
         open_uri_graphical(the_url)
-      when :text
-        case the_url.to_s
-        when /^http/
-          puts "USER ACTION: please enter this URL in a browser:\n#{the_url.to_s.red}\n"
-        else
-          puts "USER ACTION: open this:\n#{the_url.to_s.red}\n"
+      else
+        case @url_method
+        when :graphical
+          open_uri_graphical(the_url)
+        when :text
+          case the_url.to_s
+          when /^http/
+            puts "USER ACTION: please enter this URL in a browser:\n#{the_url.to_s.red}\n"
+          else
+            puts "USER ACTION: open this:\n#{the_url.to_s.red}\n"
+          end
+        else Aspera.error_unexpected_value(@url_method) { 'URL open method' }
         end
-      else Aspera.error_unexpected_value(@url_method) { 'URL open method' }
       end
     end
 

data/lib/aspera/exec_spec.rb

@@ -1,13 +1,14 @@
 # frozen_string_literal: true
 
 module Aspera
-  # Holds the executable name, environment variables and command line arguments for a spawned process.
-  ExecSpec = Struct.new(:exec, :env, :args, keyword_init: true) do
-    def initialize(exec: nil, env: {}, args: [], **) = super
+  # Holds the executable name, environment variables and command line arguments for a spawned process,
+  # and the temporary files it uses (for example a file list), which must exist until it ends.
+  ExecSpec = Struct.new(:exec, :env, :args, :temp_files, keyword_init: true) do
+    def initialize(exec: nil, env: {}, args: [], temp_files: [], **) = super
 
-    # @return [ExecSpec] deep copy with independent :args and :env
+    # @return [ExecSpec] deep copy with independent :args, :env and :temp_files
     def deep_clone
-      self.class.new(exec: exec, env: env.dup, args: args.dup)
+      self.class.new(exec: exec, env: env.dup, args: args.dup, temp_files: temp_files.dup)
     end
   end
 end

data/lib/aspera/faspex_gw.rb

@@ -2,20 +2,66 @@
 
 require 'aspera/log'
 require 'aspera/assert'
+require 'aspera/hash_ext'
 require 'aspera/mime'
+require 'aspera/secret_strength'
+require 'aspera/servlet_helpers'
+require 'aspera/web_server_simple'
 require 'webrick'
 require 'json'
 
 module Aspera
   # Simulate the Faspex 4 /send API and creates a package on Aspera on Cloud or Faspex 5
+  #
+  # Security notes:
+  # - Packages are created as the user of the application, to any recipient, and the caller receives an upload transfer spec.
+  # - Clients authenticate with HTTP Basic, as on Faspex 4, when `username` and `password` are set:
+  #   they are required when the server listens on an address that is not loopback (checked by `serve`).
+  # - Requests that a web page could send are refused (see ServletHelpers#check_request): the body shall be `application/json`.
   class Faspex4GWServlet < WEBrick::HTTPServlet::AbstractServlet
+    include ServletHelpers
+
     AOC_API = 'Aspera::Api::AoC'
     FX_API = 'Aspera::Api::Faspex'
-    # @param app_api     [Rest::Client]   API object
-    # @param app_context [String] workspace id (aoc only)
-    def initialize(server, app_api, app_context)
+    ALLOWED_PARAMETERS = %i[username password password_min_bits].freeze
+    REALM = 'Faspex 4 Gateway'
+    private_constant :REALM
+
+    class << self
+      # Check parameters and set defaults
+      # Called at startup, so that errors are reported before the first request
+      # @param parameters [Hash] Parameters of the servlet
+      # @return [Hash] Parameters with defaults
+      def normalize_parameters(parameters)
+        Aspera.assert_type(parameters, Hash)
+        parameters = parameters.symbolize_keys
+        not_allowed = parameters.keys - ALLOWED_PARAMETERS
+        Aspera.assert(not_allowed.empty?, type: ParameterError) { "unsupported parameters: #{not_allowed.join(', ')}" }
+        Aspera.assert(parameters[:username].nil? == parameters[:password].nil?, type: ParameterError) { 'Parameters username and password must be set together' }
+        parameters[:password_min_bits] ||= SecretStrength::DEFAULT_MIN_BITS
+        SecretStrength.assert_strong(parameters[:password], name: 'password', min_bits: parameters[:password_min_bits]) unless parameters[:password].nil?
+        parameters
+      end
+
+      # Start the gateway, until signal INT or TERM
+      # @param parameters [Hash]      Parameters of the server (see `WebServerSimple.url`) and of the servlet (see `normalize_parameters`)
+      # @param type       [Exception] Exception raised when the server is not protected
+      # @yieldreturn [Array] API of the application, and workspace id (AoC only), see `initialize`: called once parameters are checked
+      def serve(parameters, type: ParameterError)
+        servlet_parameters = normalize_parameters(WebServerSimple.servlet_parameters(parameters))
+        # Packages can be sent to anyone by anyone who can reach the server
+        WebServerSimple.serve(parameters, self, protected: !servlet_parameters[:username].nil?, what: 'username and password', type: type) { [servlet_parameters, *yield] }
+      end
+    end
+
+    # @param server      [WEBrick::HTTPServer] Server
+    # @param parameters  [Hash]         Parameters from `normalize_parameters`
+    # @param app_api     [Rest::Client] API object
+    # @param app_context [String]       workspace id (aoc only)
+    def initialize(server, parameters, app_api, app_context)
       Aspera.assert_values(app_api.class.name, [AOC_API, FX_API])
       super(server)
+      @expected_auth = "#{parameters[:username]}:#{parameters[:password]}" unless parameters[:username].nil?
       @app_api = app_api
       @app_context = app_context
     end
@@ -66,37 +112,57 @@ module Aspera
     end
 
     def do_POST(request, response)
-      case request.path
-      when '/aspera/faspex/send'
+      # Refuse requests of web pages
+      check_request(request, json: true)
+      return json_error(response, 401, 'Invalid or missing credentials', headers: {'WWW-Authenticate' => %Q(Basic realm="#{REALM}")}) unless authorized?(request)
+      return json_error(response, 400, 'Unsupported endpoint') unless request.path.eql?('/aspera/faspex/send')
+      faspex_pkg_parameters = package_parameters(request.body)
+      Log.dump(:faspex_pkg_parameters, faspex_pkg_parameters)
+      # compare string, as class is not yet known here
+      faspex_package_create_result =
+        case @app_api.class.name
+        when AOC_API
+          faspex4_send_to_aoc(faspex_pkg_parameters)
+        when FX_API
+          faspex4_send_to_faspex5(faspex_pkg_parameters)
+        else Aspera.error_unexpected_value(@app_api.class.name)
+        end
+      Log.dump(:faspex_package_create_result, faspex_package_create_result)
+      json_response(response, 200, faspex_package_create_result)
+    rescue WEBrick::HTTPStatus::Error => e
+      Log.log.warn { "Rejected request: #{e.message}" }
+      json_error(response, e.code, e.message)
+    rescue StandardError => e
+      # The stack trace is logged only: it is not for the caller
+      Log.log.error(e.message)
+      Log.log.debug { e.backtrace.join("\n") }
+      json_error(response, 500, e.message)
+    end
+
+    private
+
+    # @param request [WEBrick::HTTPRequest]
+    # @return [Boolean] `true` if the request has the expected Basic credentials, or if none are expected
+    def authorized?(request)
+      @expected_auth.nil? || basic_authorized?(request, @expected_auth)
+    end
+
+    # @param body [String, nil] Body of the request
+    # @return [Hash] Parameters of Faspex 4 package creation, with `delivery` and its `recipients`
+    # @raise [WEBrick::HTTPStatus::BadRequest] if the body is not a valid package creation request
+    def package_parameters(body)
+      raise WEBrick::HTTPStatus::BadRequest, 'Empty request' if body.nil?
+      parameters =
         begin
-          Aspera.assert(!request.body.nil?, 'payload missing')
-          faspex_pkg_parameters = JSON.parse(request.body)
-          Log.dump(:faspex_pkg_parameters, faspex_pkg_parameters)
-          # compare string, as class is not yet known here
-          faspex_package_create_result =
-            case @app_api.class.name
-            when AOC_API
-              faspex4_send_to_aoc(faspex_pkg_parameters)
-            when FX_API
-              faspex4_send_to_faspex5(faspex_pkg_parameters)
-            else Aspera.error_unexpected_value(@app_api.class.name)
-            end
-          Log.dump(:faspex_package_create_result, faspex_package_create_result)
-          response.status = 200
-          response.content_type = Mime::JSON
-          response.body = JSON.generate(faspex_package_create_result)
-        rescue StandardError => e
-          response.status = 500
-          response['Content-Type'] = Mime::JSON
-          response.body = {error: e.message, stacktrace: e.backtrace}.to_json
-          Log.log.error(e.message)
-          Log.log.debug { e.backtrace.join("\n") }
+          JSON.parse(body)
+        rescue JSON::ParserError
+          nil
         end
-      else
-        response.status = 400
-        response['Content-Type'] = Mime::JSON
-        response.body = {error: 'Unsupported endpoint'}.to_json
-      end
+      raise WEBrick::HTTPStatus::BadRequest, 'Request body shall be a JSON object' unless parameters.is_a?(Hash)
+      raise WEBrick::HTTPStatus::BadRequest, 'Missing object: delivery' unless parameters['delivery'].is_a?(Hash)
+      recipients = parameters['delivery']['recipients']
+      raise WEBrick::HTTPStatus::BadRequest, 'delivery.recipients shall be a non-empty list of names' unless recipients.is_a?(Array) && !recipients.empty? && recipients.all?(String)
+      parameters
     end
   end
 end

data/lib/aspera/faspex_postproc.rb

@@ -3,24 +3,93 @@
 require 'json'
 require 'timeout'
 require 'English'
+require 'ipaddr'
+require 'openssl'
 require 'webrick'
 require 'aspera/log'
 require 'aspera/assert'
-require 'aspera/mime'
+require 'aspera/environment'
+require 'aspera/hash_ext'
+require 'aspera/secret_strength'
+require 'aspera/servlet_helpers'
+require 'aspera/web_server_simple'
 
 module Aspera
   # Start a Faspex-4 style post-processing script using Faspex-5 webhook
+  #
+  # Security notes:
+  # - By default the listener binds to loopback only (url defaults to http://localhost:...).
+  #   Use a routable address only when the Faspex containers must reach this host:
+  #   then `secret_token` or `allowed_ips` is required (checked by `serve`).
+  # - Use `secret_token` so the token must be present as a `token` query parameter on every
+  #   incoming request (configure the webhook URL in Faspex as http://host:port/path?token=VALUE).
+  # - Use `allowed_ips` to restrict which source IPs or networks may call the listener.
+  # - Requests that a web page could send are refused (see ServletHelpers#check_request): the body shall be `application/json`.
+  # - Only webhook values with a key starting with `faspex_` are passed to the script.
+  # - With `lambda` in the URL query, a Ruby script (`.rb`) is evaluated in this process:
+  #   it shall return a lambda, called with the webhook values.
   class Faspex4PostProcServlet < WEBrick::HTTPServlet::AbstractServlet
-    ALLOWED_PARAMETERS = %i[root script_folder fail_on_error timeout_seconds].freeze
+    include ServletHelpers
+
+    ALLOWED_PARAMETERS = %i[root script_folder fail_on_error timeout_seconds secret_token secret_token_min_bits allowed_ips].freeze
+    # Prefix of keys of webhook values passed as environment variables: Faspex 4 post-processing variables
+    ENV_KEY_PREFIX = 'faspex_'
+    private_constant :ENV_KEY_PREFIX
+
+    class << self
+      # Check parameters and set defaults
+      # Called at startup, so that errors are reported before the first request
+      # @param parameters [Hash] Parameters of the servlet
+      # @return [Hash] Parameters with defaults, and `allowed_ips` as `IPAddr`
+      def normalize_parameters(parameters)
+        Aspera.assert_type(parameters, Hash)
+        parameters = parameters.symbolize_keys
+        not_allowed = parameters.keys - ALLOWED_PARAMETERS
+        Aspera.assert(not_allowed.empty?) { "unsupported parameters: #{not_allowed.join(', ')}" }
+        parameters[:script_folder] ||= '.'
+        parameters[:fail_on_error] ||= false
+        parameters[:timeout_seconds] ||= 60
+        parameters[:secret_token_min_bits] ||= SecretStrength::DEFAULT_MIN_BITS
+        Aspera.assert(File.directory?(parameters[:script_folder])) { "script_folder not found: #{parameters[:script_folder]}" }
+        SecretStrength.assert_strong(parameters[:secret_token], name: 'secret_token', min_bits: parameters[:secret_token_min_bits]) if parameters.key?(:secret_token)
+        # allowed_ips: optional IP addresses or networks (CIDR); nil means no restriction
+        parameters[:allowed_ips] = Array(parameters[:allowed_ips]).map { |ip| ip_address(ip) } if parameters.key?(:allowed_ips)
+        parameters
+      end
+
+      # Start the server, until signal INT or TERM
+      # Parameters are checked before: the servlet is created on each request
+      # @param parameters [Hash]      Parameters of the server (see `WebServerSimple.url`) and of the servlet (see `normalize_parameters`)
+      # @param type       [Exception] Exception raised when the server is not protected
+      def serve(parameters, type: ParameterError)
+        servlet_parameters = normalize_parameters(WebServerSimple.servlet_parameters(parameters).merge(root: WebServerSimple.url(parameters).path))
+        # Scripts can be started by anyone who can reach the server
+        WebServerSimple.serve(
+          parameters,
+          self,
+          protected: servlet_parameters.key?(:secret_token) || servlet_parameters.key?(:allowed_ips),
+          what:      'secret_token or allowed_ips',
+          type:      type
+        ) { [servlet_parameters] }
+      end
+
+      private
+
+      # @param ip [String, IPAddr] IP address or network (CIDR)
+      # @return [IPAddr] Parsed address
+      def ip_address(ip)
+        return ip if ip.is_a?(IPAddr)
+        IPAddr.new(ip)
+      rescue IPAddr::Error
+        raise ArgumentError, "allowed_ips: invalid IP address or network: #{ip}"
+      end
+    end
+
+    # @param server     [WEBrick::HTTPServer] Server
+    # @param parameters [Hash] Parameters from `normalize_parameters`: the servlet is created on each request
     def initialize(server, parameters)
-      Aspera.assert_type(parameters, Hash)
-      @parameters = parameters.symbolize_keys
+      @parameters = parameters
       Log.dump(:post_proc_parameters, @parameters)
-      not_allowed = @parameters.keys - ALLOWED_PARAMETERS
-      Aspera.assert(not_allowed.empty?) { "unsupported parameters: #{not_allowed.join(', ')}" }
-      @parameters[:script_folder] ||= '.'
-      @parameters[:fail_on_error] ||= false
-      @parameters[:timeout_seconds] ||= 60
       super(server)
       Log.log.debug { 'Faspex4PostProcServlet initialized' }
     end
@@ -28,41 +97,60 @@ module Aspera
     # :reek:UncommunicativeMethodName
     def do_POST(request, response)
       Log.log.debug { "request=#{request.path}" }
-      Log.dump(:query, request.query)
+      # `request.query` only parses a form body for POST: parameters in the URL come from the query string
+      url_query = WEBrick::HTTPUtils.parse_query(request.query_string)
+      Log.dump(:query, url_query)
+      post_proc_pid = nil
+      script_path = nil
       begin
-        # Only accept requests on the root
-        if !request.path.start_with?(@parameters[:root])
-          response.status = 400
-          response['Content-Type'] = Mime::JSON
-          response.body = {status: 'error', message: 'Request outside domain'}.to_json
-          return
+        # Refuse requests of web pages (also on localhost without protection)
+        check_request(request, json: true)
+        # Check source IP against allowlist when configured
+        if @parameters[:allowed_ips]
+          client_ip = request.peeraddr[3]
+          unless allowed_ip?(client_ip)
+            Log.log.warn { "Rejected request from disallowed IP: #{client_ip}" }
+            return error_response(response, 403, 'Forbidden')
+          end
         end
-        if request.body.nil?
-          response.status = 400
-          response['Content-Type'] = Mime::JSON
-          response.body = {status: 'error', message: 'Empty request'}.to_json
-          return
+        # Verify shared secret when configured (expected as ?token=VALUE in the URL)
+        if @parameters[:secret_token] && !OpenSSL.secure_compare(url_query['token'].to_s, @parameters[:secret_token].to_s)
+          Log.log.warn { 'Rejected request with invalid or missing token' }
+          return error_response(response, 401, 'Unauthorized')
         end
+        # Only accept requests on the root
+        return error_response(response, 400, 'Request outside domain') unless request.path.start_with?(@parameters[:root])
+        return error_response(response, 400, 'Empty request') if request.body.nil?
+        webhook_parameters =
+          begin
+            JSON.parse(request.body)
+          rescue JSON::ParserError
+            nil
+          end
+        return error_response(response, 400, 'Request body shall be a JSON object') unless webhook_parameters.is_a?(Hash)
+        Log.dump(:webhook_parameters, webhook_parameters)
         # build script path by removing domain and adding script folder
         script_file = request.path[@parameters[:root].size..]
         Log.log.debug { "script file=#{script_file}" }
-        script_path = File.join(@parameters[:script_folder], script_file)
         # Resolve the real path and ensure it stays within script_folder (prevents path traversal)
         resolved_script_folder = File.realpath(@parameters[:script_folder])
-        resolved_script_path = File.realpath(script_path)
-        Aspera.assert(resolved_script_path.start_with?("#{resolved_script_folder}/")) { 'Script path traversal attempt detected' }
-        script_path = resolved_script_path
+        begin
+          script_path = File.realpath(File.join(@parameters[:script_folder], script_file))
+        rescue Errno::ENOENT, Errno::ENOTDIR
+          return error_response(response, 404, 'Script not found')
+        end
+        unless script_path.start_with?("#{resolved_script_folder}/")
+          Log.log.warn { "Rejected script outside script_folder: #{script_path}" }
+          return error_response(response, 403, 'Script path traversal attempt detected')
+        end
+        return error_response(response, 404, 'Script not found') unless File.file?(script_path)
         Log.log.debug { "script=#{script_path}" }
-        webhook_parameters = JSON.parse(request.body)
-        Log.dump(:webhook_parameters, webhook_parameters)
         process_status = nil
-        if request.query.key?('lambda')
-          # Code can throw exception, source code must return a lambda
-          Environment.secure_eval(File.read(script_path), __FILE__, __LINE__).call(webhook_parameters)
+        if url_query.key?('lambda')
+          return error_response(response, 400, 'lambda requires a Ruby script (.rb)') unless File.extname(script_path).eql?('.rb')
+          run_lambda(script_path, webhook_parameters)
         else
-          # env expects only strings
-          environment = webhook_parameters.each_with_object({}) { |(k, v), h| h[k] = v.to_s }
-          post_proc_pid = Environment.secure_execute(script_path, mode: :background, env: environment)
+          post_proc_pid = Environment.secure_execute(script_path, mode: :background, env: script_environment(webhook_parameters))
           Timeout.timeout(@parameters[:timeout_seconds]) do
             # "wait" for process to avoid zombie
             Process.wait(post_proc_pid)
@@ -71,21 +159,76 @@ module Aspera
           process_status = $CHILD_STATUS
           Aspera.assert(process_status.success? || !@parameters[:fail_on_error]) { "script #{script_path} failed with code #{process_status.exitstatus}" }
         end
-        response.status = 200
-        response.content_type = Mime::JSON
-        response.body = JSON.generate({status: 'success', script: script_path, exit_code: process_status&.exitstatus})
+        json_response(response, 200, {status: 'success', script: script_path, exit_code: process_status&.exitstatus})
         Log.log.debug { 'Script executed successfully' }
-      rescue => e
+      rescue WEBrick::HTTPStatus::Error => e
+        Log.log.warn { "Rejected request: #{e.message}" }
+        error_response(response, e.code, e.message)
+      rescue StandardError, ScriptError => e
+        # ScriptError: syntax error in lambda script
         Log.log.error("Script failed: #{e.class}:#{e.message}")
-        if !post_proc_pid.nil?
-          Process.kill('SIGKILL', post_proc_pid)
-          Process.wait(post_proc_pid)
-          Log.log.error("Killed process: #{post_proc_pid}")
+        kill_script(post_proc_pid) unless post_proc_pid.nil?
+        error_response(response, 500, e.message, script: script_path)
+      end
+    end
+
+    private
+
+    # Set an error in the response
+    # @param response [WEBrick::HTTPResponse] Response to set
+    # @param status   [Integer] HTTP status code
+    # @param message  [String]  Error message
+    # @param info     [Hash]    Additional fields in body
+    # @return nil
+    def error_response(response, status, message, **info)
+      json_response(response, status, {status: 'error', **info, message: message})
+    end
+
+    # @param client_ip [String] Source IP address of the request
+    # @return [Boolean] `true` if the address is in one of `allowed_ips`
+    def allowed_ip?(client_ip)
+      # IPv4 clients of a dual-stack listener appear as IPv4-mapped IPv6 addresses
+      address = IPAddr.new(client_ip).native
+      @parameters[:allowed_ips].any? { |allowed| allowed.include?(address) }
+    rescue IPAddr::Error
+      false
+    end
+
+    # Environment variables of the script: same as Faspex 4 post-processing
+    # Other keys are ignored: they could change the behavior of the script (e.g. `PATH`, `LD_PRELOAD`)
+    # @param webhook_parameters [Hash] Values received in webhook
+    # @return [Hash] Environment variables, values are `String`
+    def script_environment(webhook_parameters)
+      webhook_parameters.each_with_object({}) do |(key, value), env|
+        unless key.start_with?(ENV_KEY_PREFIX)
+          Log.log.warn { "Ignoring webhook value with key not starting with #{ENV_KEY_PREFIX}: #{key.inspect}" }
+          next
         end
-        response.status = 500
-        response['Content-Type'] = Mime::JSON
-        response.body = {status: 'error', script: script_path, message: e.message}.to_json
+        # Structured values are given as JSON
+        env[key] = value.is_a?(Hash) || value.is_a?(Array) ? JSON.generate(value) : value.to_s
       end
     end
+
+    # Evaluate a Ruby script in this process, and call the lambda it returns
+    # @param script_path        [String] Path of Ruby script
+    # @param webhook_parameters [Hash]   Values received in webhook
+    def run_lambda(script_path, webhook_parameters)
+      Timeout.timeout(@parameters[:timeout_seconds]) do
+        code = Environment.secure_eval(File.read(script_path), script_path, 1)
+        Aspera.assert(code.respond_to?(:call)) { "script #{script_path} shall return a lambda" }
+        code.call(webhook_parameters)
+      end
+    end
+
+    # Kill the script after a timeout or an error
+    # @param pid [Integer] Process id of the script
+    def kill_script(pid)
+      Process.kill('SIGKILL', pid)
+      Process.wait(pid)
+      Log.log.error("Killed process: #{pid}")
+    rescue SystemCallError
+      # already terminated
+      nil
+    end
   end
 end

data/lib/aspera/formatter_interface.rb

@@ -8,7 +8,6 @@ module Aspera
   module FormatterInterface
     Aspera.require_method!(:tick)
     Aspera.require_method!(:special_format)
-    Aspera.require_method!(:check_row)
     Aspera.require_method!(:markdown_text)
   end
 end