@aws-blocks/bb-file-bucket 0.1.2 → 0.1.4

package/DESIGN.md

@@ -70,7 +70,8 @@ Creates a single S3 bucket:
   - `versions/{key}/{versionId}` (+ `.json` sidecars, `__deleted__` marker) — version history.
 - Path mapping for both the mock and the dev file-server is centralized in `paths.ts` so they stay in lockstep.
 - Data persists across dev server restarts. Customers can wipe with `rm -rf .bb-data`.
-- Presigned URLs are served by the dev file-server at `/.bb-file-bucket/{scope.fullId}/{path}?token=...`. The path segments are URL-encoded; the server decodes them and validates an HMAC token scoped to method, path, and expiry.
+- Presigned URLs are served by the dev file-server at `/.bb-file-bucket/{scope.fullId}/{path}?token=...`. The path segments are URL-encoded; the server decodes them and validates an HMAC token scoped to method, path, and expiry. The HMAC secret (`LOCAL_FILE_SECRET` in `tokens.ts`) is a **per-process random value** — the token-minting mock and the validating dev file-server share the same in-process module instance, so tokens are unforgeable without being a hardcoded, source-visible literal.
+- Downloads are served with `X-Content-Type-Options: nosniff` and `Content-Disposition: attachment`. The stored body and its `Content-Type` are caller-controlled, so serving them inline would make the dev file-server a stored-XSS vector (an uploaded `text/html`/SVG payload executing in the app origin). Forcing a download + disabling MIME sniffing keeps local dev no weaker than S3-behind-CloudFront.
 - `scan()` recursively walks only the `content/` root and yields every file it finds — no marker-based filtering — so user keys are unrestricted.
 - The dev file-server's PUT handler delegates to the registered `FileBucket` instance (via a process-global registry) so uploads get versioning, key validation, and metadata. There is no direct-write fallback; an unregistered bucket fails loud with a 500.
 - Key length validated against S3's 1,024-byte limit (warns, does not reject).

package/dist/file-server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"file-server.d.ts","sourceRoot":"","sources":["../src/file-server.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAmC,MAAM,WAAW,CAAC;AAyCzE,wBAAgB,MAAM,CAAC,UAAU,EAAE,MAAM,QAkJxC"}
+{"version":3,"file":"file-server.d.ts","sourceRoot":"","sources":["../src/file-server.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAmC,MAAM,WAAW,CAAC;AAyCzE,wBAAgB,MAAM,CAAC,UAAU,EAAE,MAAM,QAiKxC"}

package/dist/file-server.js

@@ -116,7 +116,22 @@ export function attach(httpServer) {
                 catch { }
             }
             const body = readFileSync(readPath);
-            res.writeHead(200, { 'Content-Type': contentType, 'Content-Length': body.length.toString() });
+            // The stored object body and its Content-Type are attacker-controlled
+            // (any client with a presigned PUT can upload arbitrary bytes under an
+            // arbitrary content type). Serving that back inline turns the dev file
+            // server into a stored-XSS vector: an uploaded `text/html` (or sniffed
+            // HTML/SVG) payload would execute in the origin of the local app.
+            // `nosniff` stops the browser from MIME-sniffing octet-streams into
+            // HTML, and `Content-Disposition: attachment` forces a download rather
+            // than inline rendering — so an uploaded document can never run as a
+            // page. Real S3 objects served through CloudFront are hardened the same
+            // way; this keeps local dev from being weaker than production.
+            res.writeHead(200, {
+                'Content-Type': contentType,
+                'Content-Length': body.length.toString(),
+                'X-Content-Type-Options': 'nosniff',
+                'Content-Disposition': 'attachment',
+            });
             res.end(body);
         }
         else if (req.method === 'PUT') {

package/dist/file-server.test.js

@@ -60,6 +60,28 @@ describe('file-server: basic GET/PUT', () => {
         assert.strictEqual(getRes.status, 200, `GET failed: ${getRes.status}`);
         assert.strictEqual(await getRes.text(), 'hello world');
     });
+    test('GET hardens against stored XSS: nosniff + attachment disposition', async () => {
+        // A client uploads an HTML payload under a text/html content type — the
+        // classic stored-XSS setup. When the dev server serves it back it must
+        // never let the browser render it inline in the app's origin.
+        const bucket = new FileBucket(scope, 'fs-xss');
+        const putUrl = await bucket.putUrl('payload.html', { contentType: 'text/html' });
+        const adjustedPut = putUrl.replace(/localhost:\d+/, `localhost:${port}`);
+        const putRes = await fetch(adjustedPut, {
+            method: 'PUT',
+            body: '<script>alert(document.domain)</script>',
+            headers: { 'Content-Type': 'text/html' },
+        });
+        assert.strictEqual(putRes.status, 200, `PUT failed: ${putRes.status}`);
+        const getUrl = await bucket.getUrl('payload.html');
+        const adjustedGet = getUrl.replace(/localhost:\d+/, `localhost:${port}`);
+        const getRes = await fetch(adjustedGet);
+        assert.strictEqual(getRes.status, 200, `GET failed: ${getRes.status}`);
+        assert.strictEqual(getRes.headers.get('x-content-type-options'), 'nosniff', 'GET must send X-Content-Type-Options: nosniff');
+        assert.match(getRes.headers.get('content-disposition') ?? '', /^attachment/, 'GET must force download via Content-Disposition: attachment');
+        // consume the body so the socket closes cleanly
+        await getRes.arrayBuffer();
+    });
     test('GET non-existent file returns 404', async () => {
         const bucket = new FileBucket(scope, 'fs-404');
         const url = await bucket.getUrl('missing.txt');
@@ -72,6 +94,21 @@ describe('file-server: basic GET/PUT', () => {
         const res = await fetch(url);
         assert.strictEqual(res.status, 403);
     });
+    test('a token forged with the former hardcoded secret is rejected', async () => {
+        // The signing secret used to be a fixed, source-visible literal, so anyone
+        // could mint a valid token offline for any fullId/path without ever calling
+        // getUrl()/putUrl(). It is now a per-process random secret. A token signed
+        // with the old literal must no longer validate.
+        const bucket = new FileBucket(scope, 'fs-forge');
+        const putUrl = await bucket.putUrl('secret.txt', { contentType: 'text/plain' });
+        const adjustedPut = putUrl.replace(/localhost:\d+/, `localhost:${port}`);
+        await fetch(adjustedPut, { method: 'PUT', body: 'data', headers: { 'Content-Type': 'text/plain' } });
+        const forged = mintFileToken('fsrv-fs-forge', 'secret.txt', 'GET', 3600, '__blocks_file_bucket_dev_secret__');
+        const url = `http://localhost:${port}/.bb-file-bucket/fsrv-fs-forge/secret.txt?token=${forged}`;
+        const res = await fetch(url);
+        await res.arrayBuffer();
+        assert.strictEqual(res.status, 403, 'a token forged with the old hardcoded secret must be rejected');
+    });
     test('PUT for an unregistered bucket fails loud (500), no silent write', async () => {
         // Mint a structurally valid token for a fullId that has no FileBucket
         // instance registered. The server must refuse rather than fall back to

package/dist/tokens.d.ts

@@ -1,4 +1,20 @@
-export declare const LOCAL_FILE_SECRET = "__blocks_file_bucket_dev_secret__";
+/**
+ * Per-process HMAC secret for signing local presigned-URL tokens.
+ *
+ * The mock bucket (which mints tokens) and the dev file server (which validates
+ * them) both import this module and run in the *same* dev-server process, so a
+ * value generated once at module load is shared between them via the ESM module
+ * cache — no configuration needed.
+ *
+ * This deliberately replaces a previously hardcoded literal. A fixed, source-
+ * visible secret let anyone forge a valid token for any `fullId`/path/method and
+ * hit the dev file server without ever calling `getUrl()`/`putUrl()`, defeating
+ * the point of signing. A random per-process secret makes tokens unforgeable
+ * while keeping the local round-trip working, since both ends share this value.
+ * Tokens do not need to survive a dev-server restart (presigned URLs are short-
+ * lived and re-minted on demand), so per-process randomness is sufficient.
+ */
+export declare const LOCAL_FILE_SECRET: string;
 interface FileTokenPayload {
     fullId: string;
     path: string;

package/dist/tokens.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tokens.d.ts","sourceRoot":"","sources":["../src/tokens.ts"],"names":[],"mappings":"AAQA,eAAO,MAAM,iBAAiB,sCAAsC,CAAC;AAErE,UAAU,gBAAgB;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,KAAK,GAAG,KAAK,CAAC;IACtB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,GAAG,EAAE,MAAM,CAAC;CACZ;AAED,wBAAgB,aAAa,CAC5B,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,KAAK,GAAG,KAAK,EACrB,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EACd,WAAW,CAAC,EAAE,MAAM,GAClB,MAAM,CAWR;AAED,wBAAgB,iBAAiB,CAChC,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,EACd,cAAc,EAAE,MAAM,EACtB,YAAY,EAAE,MAAM,EACpB,cAAc,EAAE,KAAK,GAAG,KAAK,GAC3B,gBAAgB,GAAG,IAAI,CAgBzB"}
+{"version":3,"file":"tokens.d.ts","sourceRoot":"","sources":["../src/tokens.ts"],"names":[],"mappings":"AAQA;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,iBAAiB,QAAwC,CAAC;AAEvE,UAAU,gBAAgB;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,KAAK,GAAG,KAAK,CAAC;IACtB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,GAAG,EAAE,MAAM,CAAC;CACZ;AAED,wBAAgB,aAAa,CAC5B,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,KAAK,GAAG,KAAK,EACrB,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EACd,WAAW,CAAC,EAAE,MAAM,GAClB,MAAM,CAWR;AAED,wBAAgB,iBAAiB,CAChC,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,EACd,cAAc,EAAE,MAAM,EACtB,YAAY,EAAE,MAAM,EACpB,cAAc,EAAE,KAAK,GAAG,KAAK,GAC3B,gBAAgB,GAAG,IAAI,CAgBzB"}

package/dist/tokens.js

@@ -1,9 +1,25 @@
 // Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
-import { createHmac } from 'node:crypto';
+import { createHmac, randomBytes } from 'node:crypto';
 import { constantTimeEquals } from '@aws-blocks/core/bb-utils';
 // ── Token helpers ───────────────────────────────────────────────────────────
-export const LOCAL_FILE_SECRET = '__blocks_file_bucket_dev_secret__';
+/**
+ * Per-process HMAC secret for signing local presigned-URL tokens.
+ *
+ * The mock bucket (which mints tokens) and the dev file server (which validates
+ * them) both import this module and run in the *same* dev-server process, so a
+ * value generated once at module load is shared between them via the ESM module
+ * cache — no configuration needed.
+ *
+ * This deliberately replaces a previously hardcoded literal. A fixed, source-
+ * visible secret let anyone forge a valid token for any `fullId`/path/method and
+ * hit the dev file server without ever calling `getUrl()`/`putUrl()`, defeating
+ * the point of signing. A random per-process secret makes tokens unforgeable
+ * while keeping the local round-trip working, since both ends share this value.
+ * Tokens do not need to survive a dev-server restart (presigned URLs are short-
+ * lived and re-minted on demand), so per-process randomness is sufficient.
+ */
+export const LOCAL_FILE_SECRET = randomBytes(32).toString('base64url');
 export function mintFileToken(fullId, path, method, expiresIn, secret, contentType) {
     const payload = {
         fullId,

package/dist/version.d.ts

@@ -1,3 +1,3 @@
 export declare const BB_NAME = "FileBucket";
-export declare const BB_VERSION = "0.1.2";
+export declare const BB_VERSION = "0.1.4";
 //# sourceMappingURL=version.d.ts.map

package/dist/version.js

@@ -1,3 +1,3 @@
 // Auto-generated by scripts/generate-version.mjs — do not edit manually
 export const BB_NAME = 'FileBucket';
-export const BB_VERSION = '0.1.2';
+export const BB_VERSION = '0.1.4';

package/package.json

@@ -1,6 +1,15 @@
 {
   "name": "@aws-blocks/bb-file-bucket",
-  "version": "0.1.2",
+  "version": "0.1.4",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/aws-devtools-labs/aws-blocks.git",
+    "directory": "packages/bb-file-bucket"
+  },
+  "homepage": "https://github.com/aws-devtools-labs/aws-blocks/tree/main/packages/bb-file-bucket#readme",
+  "bugs": {
+    "url": "https://github.com/aws-devtools-labs/aws-blocks/issues"
+  },
   "author": "Amazon Web Services",
   "license": "Apache-2.0",
   "type": "module",
@@ -41,8 +50,8 @@
     "test": "node --test dist/index.test.js dist/index.cdk.test.js dist/scan.test.js dist/file-server.test.js dist/url-encoding.test.js dist/path-containment.test.js dist/bucket-name.test.js"
   },
   "dependencies": {
-    "@aws-blocks/bb-logger": "^0.1.2",
-    "@aws-blocks/core": "^0.1.1",
+    "@aws-blocks/bb-logger": "^0.1.4",
+    "@aws-blocks/core": "^0.2.0",
     "@aws-sdk/client-s3": "^3.0.0",
     "@aws-sdk/s3-request-presigner": "^3.0.0"
   },

package/src/file-server.test.ts

@@ -72,6 +72,38 @@ describe('file-server: basic GET/PUT', () => {
 		assert.strictEqual(await getRes.text(), 'hello world');
 	});
 
+	test('GET hardens against stored XSS: nosniff + attachment disposition', async () => {
+		// A client uploads an HTML payload under a text/html content type — the
+		// classic stored-XSS setup. When the dev server serves it back it must
+		// never let the browser render it inline in the app's origin.
+		const bucket = new FileBucket(scope, 'fs-xss');
+		const putUrl = await bucket.putUrl('payload.html', { contentType: 'text/html' });
+		const adjustedPut = putUrl.replace(/localhost:\d+/, `localhost:${port}`);
+		const putRes = await fetch(adjustedPut, {
+			method: 'PUT',
+			body: '<script>alert(document.domain)</script>',
+			headers: { 'Content-Type': 'text/html' },
+		});
+		assert.strictEqual(putRes.status, 200, `PUT failed: ${putRes.status}`);
+
+		const getUrl = await bucket.getUrl('payload.html');
+		const adjustedGet = getUrl.replace(/localhost:\d+/, `localhost:${port}`);
+		const getRes = await fetch(adjustedGet);
+		assert.strictEqual(getRes.status, 200, `GET failed: ${getRes.status}`);
+		assert.strictEqual(
+			getRes.headers.get('x-content-type-options'),
+			'nosniff',
+			'GET must send X-Content-Type-Options: nosniff',
+		);
+		assert.match(
+			getRes.headers.get('content-disposition') ?? '',
+			/^attachment/,
+			'GET must force download via Content-Disposition: attachment',
+		);
+		// consume the body so the socket closes cleanly
+		await getRes.arrayBuffer();
+	});
+
 	test('GET non-existent file returns 404', async () => {
 		const bucket = new FileBucket(scope, 'fs-404');
 		const url = await bucket.getUrl('missing.txt');
@@ -87,6 +119,23 @@ describe('file-server: basic GET/PUT', () => {
 		assert.strictEqual(res.status, 403);
 	});
 
+	test('a token forged with the former hardcoded secret is rejected', async () => {
+		// The signing secret used to be a fixed, source-visible literal, so anyone
+		// could mint a valid token offline for any fullId/path without ever calling
+		// getUrl()/putUrl(). It is now a per-process random secret. A token signed
+		// with the old literal must no longer validate.
+		const bucket = new FileBucket(scope, 'fs-forge');
+		const putUrl = await bucket.putUrl('secret.txt', { contentType: 'text/plain' });
+		const adjustedPut = putUrl.replace(/localhost:\d+/, `localhost:${port}`);
+		await fetch(adjustedPut, { method: 'PUT', body: 'data', headers: { 'Content-Type': 'text/plain' } });
+
+		const forged = mintFileToken('fsrv-fs-forge', 'secret.txt', 'GET', 3600, '__blocks_file_bucket_dev_secret__');
+		const url = `http://localhost:${port}/.bb-file-bucket/fsrv-fs-forge/secret.txt?token=${forged}`;
+		const res = await fetch(url);
+		await res.arrayBuffer();
+		assert.strictEqual(res.status, 403, 'a token forged with the old hardcoded secret must be rejected');
+	});
+
 	test('PUT for an unregistered bucket fails loud (500), no silent write', async () => {
 		// Mint a structurally valid token for a fullId that has no FileBucket
 		// instance registered. The server must refuse rather than fall back to

package/src/file-server.ts

@@ -141,7 +141,22 @@ export function attach(httpServer: Server) {
 			}
 
 			const body = readFileSync(readPath);
-			res.writeHead(200, { 'Content-Type': contentType, 'Content-Length': body.length.toString() });
+			// The stored object body and its Content-Type are attacker-controlled
+			// (any client with a presigned PUT can upload arbitrary bytes under an
+			// arbitrary content type). Serving that back inline turns the dev file
+			// server into a stored-XSS vector: an uploaded `text/html` (or sniffed
+			// HTML/SVG) payload would execute in the origin of the local app.
+			// `nosniff` stops the browser from MIME-sniffing octet-streams into
+			// HTML, and `Content-Disposition: attachment` forces a download rather
+			// than inline rendering — so an uploaded document can never run as a
+			// page. Real S3 objects served through CloudFront are hardened the same
+			// way; this keeps local dev from being weaker than production.
+			res.writeHead(200, {
+				'Content-Type': contentType,
+				'Content-Length': body.length.toString(),
+				'X-Content-Type-Options': 'nosniff',
+				'Content-Disposition': 'attachment',
+			});
 			res.end(body);
 		} else if (req.method === 'PUT') {
 			const valid = validateFileToken(token, LOCAL_FILE_SECRET, fullId, path, 'PUT');

package/src/tokens.ts

@@ -1,12 +1,28 @@
 // Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 
-import { createHmac } from 'node:crypto';
+import { createHmac, randomBytes } from 'node:crypto';
 import { constantTimeEquals } from '@aws-blocks/core/bb-utils';
 
 // ── Token helpers ───────────────────────────────────────────────────────────
 
-export const LOCAL_FILE_SECRET = '__blocks_file_bucket_dev_secret__';
+/**
+ * Per-process HMAC secret for signing local presigned-URL tokens.
+ *
+ * The mock bucket (which mints tokens) and the dev file server (which validates
+ * them) both import this module and run in the *same* dev-server process, so a
+ * value generated once at module load is shared between them via the ESM module
+ * cache — no configuration needed.
+ *
+ * This deliberately replaces a previously hardcoded literal. A fixed, source-
+ * visible secret let anyone forge a valid token for any `fullId`/path/method and
+ * hit the dev file server without ever calling `getUrl()`/`putUrl()`, defeating
+ * the point of signing. A random per-process secret makes tokens unforgeable
+ * while keeping the local round-trip working, since both ends share this value.
+ * Tokens do not need to survive a dev-server restart (presigned URLs are short-
+ * lived and re-minted on demand), so per-process randomness is sufficient.
+ */
+export const LOCAL_FILE_SECRET = randomBytes(32).toString('base64url');
 
 interface FileTokenPayload {
 	fullId: string;

package/src/version.ts

@@ -1,3 +1,3 @@
 // Auto-generated by scripts/generate-version.mjs — do not edit manually
 export const BB_NAME = 'FileBucket';
-export const BB_VERSION = '0.1.2';
+export const BB_VERSION = '0.1.4';