@baique/pi-web-sky 0.1.35 → 0.1.37

package/lib/request-security.test.mjs

@@ -0,0 +1,256 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+
+async function loadSubject() {
+  return import("./request-security.ts");
+}
+
+test("allows same-origin and non-browser API requests", async () => {
+  const { isApiRequestAllowed } = await loadSubject();
+  assert.equal(isApiRequestAllowed(new Request("http://localhost:30141/api/test", {
+    method: "POST",
+    headers: {
+      host: "localhost:30141",
+      origin: "http://localhost:30141",
+      "sec-fetch-site": "same-origin",
+    },
+  })), true);
+  assert.equal(isApiRequestAllowed(new Request("http://localhost:30141/api/test", {
+    method: "POST",
+    headers: { host: "localhost:30141" },
+  })), true);
+});
+
+test("allows LAN same-origin requests when Next.js uses an internal localhost URL", async () => {
+  const { isApiRequestAllowed } = await loadSubject();
+  const request = new Request("http://localhost:30141/api/test", {
+    method: "POST",
+    headers: {
+      host: "192.168.32.7:30141",
+      origin: "http://192.168.32.7:30141",
+      "sec-fetch-site": "same-origin",
+    },
+  });
+  assert.equal(isApiRequestAllowed(request), true);
+});
+
+test("allows IPv6 and an explicitly configured hostname", async () => {
+  const { isApiRequestAllowed } = await loadSubject();
+  const ipv6 = new Request("http://localhost:30141/api/test", {
+    method: "POST",
+    headers: {
+      host: "[::1]:30141",
+      origin: "http://[::1]:30141",
+      "sec-fetch-site": "same-origin",
+    },
+  });
+  const configured = new Request("http://localhost:30141/api/test", {
+    method: "POST",
+    headers: {
+      host: "pi-web.internal:30141",
+      origin: "http://pi-web.internal:30141",
+      "sec-fetch-site": "same-origin",
+    },
+  });
+  assert.equal(isApiRequestAllowed(ipv6), true);
+  assert.equal(isApiRequestAllowed(configured, ["pi-web.internal"]), true);
+});
+
+test("rejects cross-origin browser API requests", async () => {
+  const { isApiRequestAllowed, shouldCheckApiRequestOrigin } = await loadSubject();
+  const post = new Request("http://localhost:30141/api/test", {
+    method: "POST",
+    headers: {
+      host: "localhost:30141",
+      origin: "https://attacker.example",
+      "sec-fetch-site": "cross-site",
+    },
+  });
+  const crossSiteGet = new Request("http://localhost:30141/api/sessions", {
+    headers: { host: "localhost:30141", "sec-fetch-site": "cross-site" },
+  });
+  assert.equal(shouldCheckApiRequestOrigin(post), true);
+  assert.equal(isApiRequestAllowed(post), false);
+  assert.equal(shouldCheckApiRequestOrigin(crossSiteGet), true);
+  assert.equal(isApiRequestAllowed(crossSiteGet), false);
+});
+
+test("does not globally trust opaque iframe or alternate loopback origins", async () => {
+  const { isApiRequestAllowed } = await loadSubject();
+  const previewUrl = "http://localhost:30141/api/files/tmp/test.docx?type=preview";
+  const opaqueIframe = new Request(previewUrl, {
+    headers: {
+      host: "localhost:30141",
+      origin: "null",
+      "sec-fetch-site": "cross-site",
+      "sec-fetch-mode": "navigate",
+      "sec-fetch-dest": "iframe",
+    },
+  });
+  const alternateLoopback = new Request(previewUrl, {
+    headers: {
+      host: "localhost:30141",
+      origin: "http://127.0.0.1:30141",
+      "sec-fetch-site": "cross-site",
+    },
+  });
+
+  assert.equal(isApiRequestAllowed(opaqueIframe), false);
+  assert.equal(isApiRequestAllowed(alternateLoopback), false);
+});
+
+test("allows only user-initiated session export document navigations from a PWA", async () => {
+  const { isApiRequestAllowed } = await loadSubject();
+  const navigationHeaders = {
+    host: "127.0.0.1:30141",
+    "sec-fetch-site": "cross-site",
+    "sec-fetch-mode": "navigate",
+    "sec-fetch-dest": "document",
+    "sec-fetch-user": "?1",
+  };
+
+  assert.equal(isApiRequestAllowed(new Request(
+    "http://127.0.0.1:30141/api/sessions/session-id/export?inline=1",
+    { headers: navigationHeaders },
+  )), true);
+  assert.equal(isApiRequestAllowed(new Request(
+    "http://127.0.0.1:30141/api/sessions",
+    { headers: navigationHeaders },
+  )), false);
+  assert.equal(isApiRequestAllowed(new Request(
+    "http://127.0.0.1:30141/api/sessions/session-id/export?inline=1",
+    { headers: { ...navigationHeaders, "sec-fetch-dest": "empty" } },
+  )), false);
+  assert.equal(isApiRequestAllowed(new Request(
+    "http://127.0.0.1:30141/api/sessions/session-id/export?inline=1",
+    {
+      headers: {
+        ...navigationHeaders,
+        "sec-fetch-user": "",
+      },
+    },
+  )), false);
+  assert.equal(isApiRequestAllowed(new Request(
+    "http://127.0.0.1:30141/api/sessions/session-id/export?inline=1",
+    { method: "POST", headers: navigationHeaders },
+  )), false);
+  assert.equal(isApiRequestAllowed(new Request(
+    "http://127.0.0.1:30141/api/sessions/session-id/export?inline=1",
+    { headers: { ...navigationHeaders, host: "attacker.example:30141" } },
+  )), false);
+});
+
+test("rejects an origin that does not match the external request host", async () => {
+  const { isApiRequestAllowed } = await loadSubject();
+  const request = new Request("http://localhost:30141/api/test", {
+    method: "POST",
+    headers: {
+      host: "192.168.32.7:30141",
+      origin: "http://attacker.example",
+      "sec-fetch-site": "same-site",
+    },
+  });
+  assert.equal(isApiRequestAllowed(request), false);
+});
+
+test("rejects DNS rebinding even when browser headers say same-origin", async () => {
+  const { isApiRequestAllowed } = await loadSubject();
+  const request = new Request("http://localhost:30141/api/skills/install", {
+    method: "POST",
+    headers: {
+      host: "attacker.example:30141",
+      origin: "http://attacker.example:30141",
+      "sec-fetch-site": "same-origin",
+      "content-type": "application/json",
+    },
+  });
+  assert.equal(isApiRequestAllowed(request), false);
+});
+
+test("rejects missing, malformed, and unconfigured Host headers", async () => {
+  const { isApiRequestAllowed } = await loadSubject();
+  assert.equal(isApiRequestAllowed(new Request("http://localhost:30141/api/test")), false);
+  assert.equal(isApiRequestAllowed(new Request("http://localhost:30141/api/test", {
+    headers: { host: "localhost@attacker.example:30141" },
+  })), false);
+  assert.equal(isApiRequestAllowed(new Request("http://localhost:30141/api/test", {
+    headers: { host: "pi-web.internal:30141" },
+  })), false);
+});
+
+test("allows same-origin requests when Chromium strips the port from Origin", async () => {
+  const { isApiRequestAllowed } = await loadSubject();
+  // Loopback IP with the port stripped from Origin (Chromium 150+ behavior).
+  const loopback = new Request("http://127.0.0.1:30141/api/agent/running", {
+    headers: {
+      host: "127.0.0.1:30141",
+      origin: "http://127.0.0.1",
+      "sec-fetch-site": "same-origin",
+    },
+  });
+  assert.equal(isApiRequestAllowed(loopback), true);
+
+  // LAN IP with the port stripped from Origin.
+  const lan = new Request("http://192.168.32.7:30141/api/test", {
+    method: "POST",
+    headers: {
+      host: "192.168.32.7:30141",
+      origin: "http://192.168.32.7",
+      "sec-fetch-site": "same-origin",
+      "content-type": "application/json",
+    },
+  });
+  assert.equal(isApiRequestAllowed(lan), true);
+
+  // Loopback name with the port stripped from Origin.
+  const named = new Request("http://localhost:30141/api/test", {
+    method: "POST",
+    headers: {
+      host: "localhost:30141",
+      origin: "http://localhost",
+      "sec-fetch-site": "same-origin",
+      "content-type": "application/json",
+    },
+  });
+  assert.equal(isApiRequestAllowed(named), true);
+});
+
+test("still rejects when Origin hostname differs from Host even with port stripped", async () => {
+  const { isApiRequestAllowed } = await loadSubject();
+  // Cross-loopback-name origin should not slip through just because both
+  // sides happen to be loopback addresses.
+  const crossName = new Request("http://localhost:30141/api/test", {
+    headers: {
+      host: "localhost:30141",
+      origin: "http://127.0.0.1",
+      "sec-fetch-site": "same-origin",
+    },
+  });
+  assert.equal(isApiRequestAllowed(crossName), false);
+
+  // Attacker host matching its own Origin must still be blocked by the
+  // Host allowlist, not the Origin comparison.
+  const dnsRebind = new Request("http://localhost:30141/api/skills/install", {
+    method: "POST",
+    headers: {
+      host: "attacker.example:30141",
+      origin: "http://attacker.example",
+      "sec-fetch-site": "same-origin",
+      "content-type": "application/json",
+    },
+  });
+  assert.equal(isApiRequestAllowed(dnsRebind), false);
+});
+
+test("recognizes JSON request content types", async () => {
+  const { hasJsonContentType } = await loadSubject();
+  assert.equal(hasJsonContentType(new Request("http://localhost", {
+    headers: { "content-type": "application/json; charset=utf-8" },
+  })), true);
+  assert.equal(hasJsonContentType(new Request("http://localhost", {
+    headers: { "content-type": "application/problem+json" },
+  })), true);
+  assert.equal(hasJsonContentType(new Request("http://localhost", {
+    headers: { "content-type": "text/plain" },
+  })), false);
+});

package/lib/request-security.ts

@@ -0,0 +1,136 @@
+import { isIP } from "node:net";
+
+function normalizeHostname(value: string): string {
+  const unbracketed = value.startsWith("[") && value.endsWith("]")
+    ? value.slice(1, -1)
+    : value;
+  return unbracketed.toLowerCase().replace(/\.$/, "");
+}
+
+function hostnameFromAuthority(value: string): string | null {
+  if (!value || /[\s/@\\]/.test(value)) return null;
+  try {
+    const parsed = new URL(`http://${value}`);
+    if (parsed.username || parsed.password || parsed.pathname !== "/" || parsed.search || parsed.hash) {
+      return null;
+    }
+    return normalizeHostname(parsed.hostname);
+  } catch {
+    return null;
+  }
+}
+
+function normalizeConfiguredHostname(value: string | undefined): string | null {
+  const trimmed = value?.trim();
+  if (!trimmed) return null;
+  return isIP(trimmed) ? normalizeHostname(trimmed) : hostnameFromAuthority(trimmed);
+}
+
+function isLoopbackHostname(hostname: string): boolean {
+  return hostname === "localhost" || hostname.endsWith(".localhost");
+}
+
+function configuredHostnamesFromEnvironment(): string[] {
+  return [
+    process.env.PI_WEB_HOSTNAME,
+    ...(process.env.PI_WEB_ALLOWED_HOSTS?.split(",") ?? []),
+  ].filter((value): value is string => Boolean(value?.trim()));
+}
+
+function canonicalOrigin(value: string): string | null {
+  try {
+    return new URL(value).origin;
+  } catch {
+    return null;
+  }
+}
+
+function getRequestOrigin(request: Request): string | null {
+  const requestUrl = new URL(request.url);
+  const host = request.headers.get("host");
+  return host ? canonicalOrigin(`${requestUrl.protocol}//${host}`) : null;
+}
+
+function isUserInitiatedSessionExportNavigation(request: Request): boolean {
+  if (
+    request.method !== "GET"
+    || request.headers.get("sec-fetch-mode") !== "navigate"
+    || request.headers.get("sec-fetch-dest") !== "document"
+    || request.headers.get("sec-fetch-user") !== "?1"
+  ) {
+    return false;
+  }
+
+  try {
+    return /^\/api\/sessions\/[^/]+\/export$/.test(new URL(request.url).pathname);
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Only trust local names, IP literals, or the hostname explicitly selected by
+ * the operator. IP literals preserve LAN access but cannot be DNS-rebound
+ * because the browser keeps the literal address in the Host header.
+ */
+export function isApiRequestHostAllowed(
+  request: Request,
+  configuredHostnames = configuredHostnamesFromEnvironment(),
+): boolean {
+  const host = request.headers.get("host");
+  const hostname = host ? hostnameFromAuthority(host) : null;
+  if (!hostname) return false;
+  if (isLoopbackHostname(hostname) || isIP(hostname)) return true;
+
+  return configuredHostnames.some(
+    (configured) => normalizeConfiguredHostname(configured) === hostname,
+  );
+}
+
+function originHostname(value: string): string | null {
+  try {
+    return new URL(value).hostname;
+  } catch {
+    return null;
+  }
+}
+
+/** Reject browser cross-site API requests while preserving non-browser clients. */
+export function isApiRequestOriginAllowed(request: Request): boolean {
+  const origin = request.headers.get("origin");
+  const fetchSite = request.headers.get("sec-fetch-site");
+  if (fetchSite === "cross-site") return false;
+  if (!origin) return true;
+
+  // Chromium 150+ strips the port from the Origin header for same-origin
+  // requests on non-default ports. Strict canonical-origin comparison would
+  // therefore reject those legitimate requests ("http://127.0.0.1:30141"
+  // vs. the browser-sent "http://127.0.0.1"). The Host header is the
+  // authoritative source for where the request actually went, so accept any
+  // Origin whose hostname matches it. Hostnames are case-insensitive, which
+  // the URL constructor already handles for us.
+  const requestOrigin = getRequestOrigin(request);
+  if (!requestOrigin) return false;
+  const originHost = originHostname(origin);
+  const requestHost = originHostname(requestOrigin);
+  return originHost !== null && originHost === requestHost;
+}
+
+export function shouldCheckApiRequestOrigin(request: Request): boolean {
+  return request.headers.has("origin") || request.headers.has("sec-fetch-site");
+}
+
+export function isApiRequestAllowed(
+  request: Request,
+  configuredHostnames = configuredHostnamesFromEnvironment(),
+): boolean {
+  if (!isApiRequestHostAllowed(request, configuredHostnames)) return false;
+  if (isUserInitiatedSessionExportNavigation(request)) return true;
+  return !shouldCheckApiRequestOrigin(request) || isApiRequestOriginAllowed(request);
+}
+
+export function hasJsonContentType(request: Request): boolean {
+  const mediaType = request.headers.get("content-type")?.split(";", 1)[0]?.trim().toLowerCase();
+  return mediaType === "application/json"
+    || Boolean(mediaType?.startsWith("application/") && mediaType.endsWith("+json"));
+}