@appsemble/node-utils 0.36.2-test.5 → 0.36.3-test.5

package/README.md

@@ -1,9 +1,9 @@
-# ![](https://gitlab.com/appsemble/appsemble/-/raw/0.36.2-test.5/config/assets/logo.svg) Appsemble Node Utilities
+# ![](https://gitlab.com/appsemble/appsemble/-/raw/0.36.3-test.5/config/assets/logo.svg) Appsemble Node Utilities
 
 > NodeJS utilities used by Appsemble internally.
 
 [![npm](https://img.shields.io/npm/v/@appsemble/node-utils)](https://www.npmjs.com/package/@appsemble/node-utils)
-[![GitLab CI](https://gitlab.com/appsemble/appsemble/badges/0.36.2-test.5/pipeline.svg)](https://gitlab.com/appsemble/appsemble/-/releases/0.36.2-test.5)
+[![GitLab CI](https://gitlab.com/appsemble/appsemble/badges/0.36.3-test.5/pipeline.svg)](https://gitlab.com/appsemble/appsemble/-/releases/0.36.3-test.5)
 [![Prettier](https://img.shields.io/badge/code_style-prettier-ff69b4.svg)](https://prettier.io)
 
 ## Table of Contents
@@ -26,5 +26,5 @@ compatibility is not guaranteed.
 
 ## License
 
-[LGPL-3.0-only](https://gitlab.com/appsemble/appsemble/-/blob/0.36.2-test.5/LICENSE.md) ©
+[LGPL-3.0-only](https://gitlab.com/appsemble/appsemble/-/blob/0.36.3-test.5/LICENSE.md) ©
 [Appsemble](https://appsemble.com)

package/authentication.js

@@ -1,6 +1,6 @@
 import { AppsembleError, logger } from '@appsemble/node-utils';
+import { select } from '@inquirer/prompts';
 import axios from 'axios';
-import inquirer from 'inquirer';
 export const CREDENTIALS_ENV_VAR = 'APPSEMBLE_CLIENT_CREDENTIALS';
 const authorizedRemotes = new Set();
 export function getService(remote) {
@@ -34,14 +34,10 @@ async function getClientCredentials(remote, inputCredentials) {
         [choice] = choices;
     }
     else {
-        ({ choice } = await inquirer.prompt([
-            {
-                name: 'choice',
-                message: 'Select client id to use',
-                choices: choices.map((value) => ({ name: value.account, value })),
-                type: 'list',
-            },
-        ]));
+        choice = await select({
+            message: 'Select client id to use',
+            choices: choices.map((value) => ({ name: value.account, value })),
+        });
     }
     return `${choice.account}:${choice.password}`;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@appsemble/node-utils",
-  "version": "0.36.2-test.5",
+  "version": "0.36.3-test.5",
   "description": "NodeJS utilities used by Appsemble internally.",
   "keywords": [
     "app",
@@ -40,10 +40,9 @@
     "test": "vitest"
   },
   "dependencies": {
-    "@appsemble/lang-sdk": "0.36.2-test.5",
-    "@appsemble/types": "0.36.2-test.5",
-    "@appsemble/utils": "0.36.2-test.5",
-    "@appsemble/webpack-core": "0.36.2-test.5",
+    "@appsemble/lang-sdk": "0.36.3-test.5",
+    "@appsemble/types": "0.36.3-test.5",
+    "@appsemble/utils": "0.36.3-test.5",
     "@formatjs/fast-memoize": "^2.0.0",
     "@fortawesome/fontawesome-free": "^6.0.0",
     "@kubernetes/client-node": "^0.22.2",
@@ -65,11 +64,11 @@
     "fast-glob": "^3.0.0",
     "form-data": "^4.0.4",
     "fs-extra": "^11.0.0",
-    "inquirer": "^9.0.0",
+    "@inquirer/prompts": "^8.0.0",
     "intl-messageformat": "^11.0.0",
     "jsonschema": "~1.4.1",
     "keytar": "^7.0.0",
-    "koa": "^2.0.0",
+    "koa": "^3.0.0",
     "koa-compose": "^4.0.0",
     "koa-mount": "^4.0.0",
     "koa-static": "^5.0.0",
@@ -82,7 +81,7 @@
     "lodash": "^4.0.0",
     "lodash-es": "^4.0.0",
     "logform": "^2.0.0",
-    "memfs": "^4.17.0",
+    "memfs": "4.17.0",
     "mime-types": "^2.0.0",
     "minio": "^8.0.3",
     "mustache": "^4.0.0",
@@ -90,6 +89,7 @@
     "parse-duration": "^1.0.0",
     "parse-json": "^8.0.0",
     "pg": "^8.16.3",
+    "request-filtering-agent": "^3.2.0",
     "sass": "^1.0.0",
     "sharp": "^0.32.0",
     "sort-keys": "^5.0.0",
@@ -108,7 +108,7 @@
     "@types/css-tree": "2.3.11",
     "@types/express-to-koa": "1.0.4",
     "@types/koa-mount": "4.0.5",
-    "@types/mustache": "4.2.5",
+    "@types/mustache": "4.2.6",
     "@types/type-is": "1.6.7",
     "@types/uuid": "10.0.0",
     "axios-mock-adapter": "1.22.0",
@@ -124,6 +124,6 @@
     }
   },
   "engines": {
-    "node": ">=20"
+    "node": ">=24"
   }
 }

package/readAsset.d.ts

@@ -1,4 +1,4 @@
-export declare const assetDir: import("node:url").URL;
+export declare const assetDir: import("url").URL;
 /**
  * Read a file from the server assets directory.
  *

package/server/routes/appRouter/indexHandler.js

@@ -34,9 +34,9 @@ export function createIndexHandler({ createSettings, getApp, getAppDetails, getA
         }
         const appUrl = await getAppUrl({ app, context: ctx });
         if (appUrl.hostname !== hostname) {
-            appUrl.pathname = path;
-            appUrl.search = ctx.querystring;
-            ctx.redirect(String(appUrl));
+            const redirectUrl = new URL(path, appUrl);
+            redirectUrl.search = ctx.search;
+            ctx.redirect(String(redirectUrl));
             return;
         }
         const defaultLanguage = app.definition.defaultLanguage || defaultLocale;

package/server/routes/appRouter/securityHandler.d.ts

@@ -1,3 +1,3 @@
 import { type Middleware } from 'koa';
 import { type Options } from '../../../index.js';
-export declare function createSecurityHandler({ getApp }: Options): Middleware;
+export declare function createSecurityHandler({ getApp, getSecurityEmail }: Options): Middleware;

package/server/routes/appRouter/securityHandler.js

@@ -1,11 +1,20 @@
 import { addDays } from 'date-fns';
 import { assertKoaCondition } from '../../../index.js';
-export function createSecurityHandler({ getApp }) {
+export function createSecurityHandler({ getApp, getSecurityEmail }) {
     return async (ctx) => {
         const app = await getApp({ context: ctx, query: { attributes: ['id', 'updated'] } });
         assertKoaCondition(app != null, ctx, 404, 'App not found');
         const expires = addDays(new Date(app.$updated ?? app.$created), 180);
-        ctx.body = `Contact: mailto:security@appsemble.com\nExpires: ${expires}`;
+        const securityEmail = getSecurityEmail();
+        ctx.type = 'text/plain; charset=utf-8';
+        ctx.body = [
+            `Contact: mailto:${securityEmail}`,
+            `Expires: ${expires.toISOString().replace(/\.\d{3}Z$/, 'Z')}`,
+            `Canonical: ${ctx.URL.origin}/.well-known/security.txt`,
+            'Policy: https://gitlab.com/appsemble/appsemble/-/blob/main/SECURITY.md',
+            'Preferred-Languages: en, nl',
+            '',
+        ].join('\n');
     };
 }
 //# sourceMappingURL=securityHandler.js.map

package/server/types.d.ts

@@ -373,6 +373,7 @@ export interface ParsedQuery {
 }
 export type ContentSecurityPolicy = Record<string, (string | false)[]>;
 export interface Options {
+    getSecurityEmail: () => string;
     getCurrentAppMember: (params: GetCurrentAppMemberParams) => Promise<AppMemberInfo | null>;
     getCurrentAppMemberSelectedGroup: (params: GetCurrentAppMemberSelectedGroupParams) => Promise<AppMemberGroup | null>;
     getCurrentAppMemberGroups: (params: GetCurrentAppMemberGroupsParams) => Promise<Group[] | null>;

package/server/utils/actions.js

@@ -2,6 +2,7 @@ import { defaultLocale, remap, } from '@appsemble/lang-sdk';
 import { assertKoaCondition, createFormData, EmailQuotaExceededError, getContainerNamespace, getRemapperContext, logger, parseServiceUrl, scaleDeployment, setLastRequestAnnotation, throwKoaError, version, waitForPodReadiness, } from '@appsemble/node-utils';
 import axios from 'axios';
 import { get, mapValues, pick } from 'lodash-es';
+import { RequestFilteringHttpAgent, RequestFilteringHttpsAgent } from 'request-filtering-agent';
 /**
  * These response headers are forwarded when proxying requests.
  */
@@ -121,6 +122,18 @@ async function handleRequestProxy(ctx, app, action, useBody, options) {
     axiosConfig.decompress = false;
     let response;
     const containerUrlPattern = /^http:\/\/(([\da-z-]+).){2}svc.cluster.local/;
+    let isValidCompanionContainer = false;
+    // Block known Kubernetes internal hostnames that don't match the container pattern
+    const kubernetesInternalHostnames = [
+        'kubernetes',
+        'kubernetes.default',
+        'kubernetes.default.svc',
+        'kubernetes.default.svc.cluster.local',
+    ];
+    if (kubernetesInternalHostnames.includes(proxyUrl.hostname.toLowerCase())) {
+        logger.warn(`SSRF blocked: Kubernetes internal hostname ${proxyUrl.hostname}`);
+        throwKoaError(ctx, 403, 'Access to Kubernetes internal services is not allowed');
+    }
     // Restricting access to only the containers defined by the app
     if (containerUrlPattern.test(String(proxyUrl))) {
         axiosConfig.url = axiosConfig.url?.replace(axiosConfig.url.split('.')[1], getContainerNamespace());
@@ -128,6 +141,29 @@ async function handleRequestProxy(ctx, app, action, useBody, options) {
         if (appId !== String(app.id)) {
             throwKoaError(ctx, 403, 'Forbidden');
         }
+        isValidCompanionContainer = true;
+    }
+    else {
+        // Apply SSRF protection for non-companion-container URLs
+        // This blocks requests to private IPs, localhost, link-local addresses,
+        // and hostnames that resolve to private IPs (prevents DNS rebinding attacks)
+        //
+        // VITEST_CONF_ALLOW_PRIVATE_IP_PROXY: Test-only env var set in vitest.setup.ts
+        // to allow proxy tests to use localhost servers. SSRF tests explicitly unset this.
+        // This env var should NEVER be set in production.
+        const allowPrivateIPAddress = process.env.VITEST_CONF_ALLOW_PRIVATE_IP_PROXY === '1';
+        // Preserve any existing agent options (e.g., client certs from applyAppServiceSecrets)
+        // while still applying SSRF protection
+        const existingHttpsOptions = axiosConfig.httpsAgent?.options ?? {};
+        const existingHttpOptions = axiosConfig.httpAgent?.options ?? {};
+        axiosConfig.httpAgent = new RequestFilteringHttpAgent({
+            ...existingHttpOptions,
+            allowPrivateIPAddress,
+        });
+        axiosConfig.httpsAgent = new RequestFilteringHttpsAgent({
+            ...existingHttpsOptions,
+            allowPrivateIPAddress,
+        });
     }
     logger.verbose(`Forwarding request to ${axios.getUri(axiosConfig)}`);
     logger.verbose('Axios Config:');
@@ -137,9 +173,15 @@ async function handleRequestProxy(ctx, app, action, useBody, options) {
         logger.verbose(response);
     }
     catch (err) {
+        // Check if this is an SSRF block from request-filtering-agent
+        const errorMessage = err instanceof Error ? err.message : String(err);
+        if (errorMessage.includes('is not allowed') || errorMessage.includes('private')) {
+            logger.warn(`SSRF blocked: ${errorMessage}`);
+            throwKoaError(ctx, 403, 'Access to private network addresses is not allowed');
+        }
         // If request is sent to a companion container and fails
         // Try to start it anew and retry the request
-        if (containerUrlPattern.test(String(proxyUrl))) {
+        if (isValidCompanionContainer) {
             const { deploymentName, namespace } = parseServiceUrl(String(proxyUrl));
             try {
                 await scaleDeployment(namespace, deploymentName, 1);