@antelopejs/dms-frontend 0.5.4 → 0.5.5

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@antelopejs/dms-frontend",
-  "version": "0.5.4",
+  "version": "0.5.5",
   "description": "Frontend-agnostic loader for AntelopeJS DMS, shipping the Vue 3 renderer (Vite, Inertia, SSR)",
   "keywords": [
     "antelope",

package/templates/vue/server/request-target.mjs

@@ -0,0 +1,53 @@
+import { writeBadRequest } from "./request-failure.mjs";
+
+// The request target as the server reads it. Node hands `request.url` over
+// verbatim, so it is not always a path: `//host/x`, `/\host/x` and the
+// absolute form `http://host/x` all name another host once resolved, which
+// turned the proxy into an open one. Every routing decision and the URL sent to
+// the backend read the same normalized path from here.
+
+const FRONTEND_ORIGIN = "http://frontend.local";
+
+/**
+ * Whether `target` is an origin-form request target: a path, optionally with a
+ * query, that stays on this server once resolved. Anything else (an absolute
+ * or authority form, `*`, a path a URL parser reads as another host) is not a
+ * request a browser sends to the frontend.
+ */
+export function isOriginForm(target) {
+  if (typeof target !== "string" || !target.startsWith("/")) return false;
+  try {
+    return new URL(target, FRONTEND_ORIGIN).origin === FRONTEND_ORIGIN;
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * The backend URL a request target is proxied to: the target's normalized path
+ * and query on the backend's origin. The path is set, not resolved, so a path
+ * normalizing to `//host` (`/x/..//host`) stays a path on the backend.
+ *
+ * @param target The request target, origin-form
+ * @param backendBaseUrl The backend's base URL
+ */
+export function backendUrl(
+  target,
+  backendBaseUrl = process.env.DMS_API_BASE_URL,
+) {
+  const { pathname, search } = new URL(target, FRONTEND_ORIGIN);
+  const url = new URL(new URL(backendBaseUrl).origin);
+  url.pathname = pathname;
+  url.search = search;
+  return url;
+}
+
+/**
+ * Answers 400 to a request whose target is not origin-form, before any route
+ * reads it. Returns whether it answered.
+ */
+export function refuseForeignTarget(request, response) {
+  if (isOriginForm(request.url)) return false;
+  writeBadRequest(response);
+  return true;
+}

package/templates/vue/server.mjs

@@ -42,6 +42,7 @@ import { HOMEPAGE } from "./server/homepage.mjs";
 import { htmlTag } from "./server/html-tag.mjs";
 import * as icons from "./server/icons.mjs";
 import * as requestFailure from "./server/request-failure.mjs";
+import { backendUrl, refuseForeignTarget } from "./server/request-target.mjs";
 import { handleTester } from "./server/tester.mjs";
 import {
   createInertiaPage,
@@ -239,12 +240,11 @@ async function proxy(request, response, fallbackOnNotFound = false) {
     refuseCrossOrigin(response);
     return true;
   }
-  const target = new URL(request.url, process.env.DMS_API_BASE_URL);
   // Cancelling the body alone misses a client that leaves before the backend
   // answers: its stream, an SSE feed above all, then stayed open for good.
   const abandoned = new AbortController();
   response.once("close", () => abandoned.abort());
-  const upstream = await fetch(target, {
+  const upstream = await fetch(backendUrl(request.url), {
     signal: abandoned.signal,
     method: request.method,
     headers: backendHeaders(request, publicEndpoint),
@@ -505,6 +505,7 @@ async function writeRequestFailure(error, request, response) {
 
 export async function handleRequestSafely(request, response) {
   try {
+    if (refuseForeignTarget(request, response)) return;
     await handleRequest(request, response);
   } catch (error) {
     // An error page failing too must not reject: that would end the process.