@bygghammar/cms-platform 0.80.1 → 0.90.0-m7.1

package/src/server/webhook-url-guard.ts

@@ -0,0 +1,199 @@
+/**
+ * Where an outbound webhook is allowed to go.
+ *
+ * A webhook endpoint is a URL an administrator types in, and the server then
+ * fetches it. That is a server-side request forgery primitive unless something
+ * stops it: without this guard, "https://169.254.169.254/latest/meta-data/"
+ * turns the CMS into a proxy for reading the host's cloud credentials, and
+ * "https://127.0.0.1:5432" turns it into a port scanner for the private
+ * network the server sits in.
+ *
+ * So the rule is an allowlist of shapes, not a blocklist of strings:
+ *   - https only, never http, never file:, gopher:, data: or anything else;
+ *   - no credentials in the URL;
+ *   - a hostname that is not a literal IP address in any private, loopback,
+ *     link-local, unique-local or otherwise special range;
+ *   - no hostname that is a known cloud-metadata name.
+ *
+ * DNS is deliberately NOT resolved here. A name can resolve to a public
+ * address at validation time and a private one at delivery time, so the
+ * defence that matters is re-checking every hop at fetch time — which is what
+ * `safeFetch` does, including on each redirect.
+ *
+ * Server-only. Never import from client code.
+ */
+
+export type UrlRejection =
+  | "not-a-url"
+  | "not-https"
+  | "has-credentials"
+  | "blocked-host"
+  | "blocked-ip"
+  | "too-long";
+
+export type UrlCheck =
+  | { readonly ok: true; readonly url: URL }
+  | {
+      readonly ok: false;
+      readonly reason: UrlRejection;
+      /** Safe to show an administrator: never contains a resolved address. */
+      readonly message: string;
+    };
+
+const MAX_URL_LENGTH = 2048;
+
+/** Hostnames that address the machine or its cloud environment, never a customer's server. */
+const BLOCKED_HOSTNAMES: ReadonlySet<string> = new Set([
+  "localhost",
+  "localhost.localdomain",
+  "ip6-localhost",
+  "ip6-loopback",
+  // Cloud instance metadata. Reaching any of these leaks the host's own
+  // credentials, which is the single highest-value target of an SSRF.
+  "metadata",
+  "metadata.google.internal",
+  "metadata.goog",
+  "instance-data",
+]);
+
+/** Suffixes that only ever name something inside the network the server is on. */
+const BLOCKED_SUFFIXES: readonly string[] = [
+  ".localhost",
+  ".local",
+  ".internal",
+  ".intranet",
+  ".private",
+  ".corp",
+  ".home",
+  ".lan",
+];
+
+function parseIPv4(host: string): readonly number[] | null {
+  const parts = host.split(".");
+  if (parts.length !== 4) return null;
+  const octets = parts.map((part) => {
+    if (!/^\d{1,3}$/.test(part)) return -1;
+    const value = Number(part);
+    return value >= 0 && value <= 255 ? value : -1;
+  });
+  return octets.some((o) => o < 0) ? null : octets;
+}
+
+/** Every IPv4 range that is not a routable, public destination. */
+function isBlockedIPv4(octets: readonly number[]): boolean {
+  const [a, b] = octets as [number, number, number, number];
+  if (a === 0) return true; // "this network"
+  if (a === 10) return true; // private
+  if (a === 127) return true; // loopback
+  if (a === 169 && b === 254) return true; // link-local, incl. cloud metadata
+  if (a === 172 && b >= 16 && b <= 31) return true; // private
+  if (a === 192 && b === 168) return true; // private
+  if (a === 192 && b === 0) return true; // IETF protocol assignments
+  if (a === 100 && b >= 64 && b <= 127) return true; // carrier-grade NAT
+  if (a === 198 && (b === 18 || b === 19)) return true; // benchmarking
+  if (a >= 224) return true; // multicast and reserved, incl. 255.255.255.255
+  return false;
+}
+
+/**
+ * IPv6, including the forms that smuggle an IPv4 address inside one.
+ *
+ * `::ffff:127.0.0.1` and `::ffff:7f00:1` are both loopback wearing a different
+ * hat, and a guard that only looked at the textual prefix would pass them.
+ */
+function isBlockedIPv6(host: string): boolean {
+  const address = host.replace(/^\[|\]$/g, "").toLowerCase();
+  if (address === "::" || address === "::1") return true;
+
+  const mapped = /^::ffff:(\d{1,3}(?:\.\d{1,3}){3})$/.exec(address);
+  if (mapped !== null) {
+    const octets = parseIPv4(mapped[1] as string);
+    return octets === null || isBlockedIPv4(octets);
+  }
+  // ::ffff:7f00:1 — the same address written as hex groups.
+  const hexMapped = /^::ffff:([0-9a-f]{1,4}):([0-9a-f]{1,4})$/.exec(address);
+  if (hexMapped !== null) {
+    const high = Number.parseInt(hexMapped[1] as string, 16);
+    const low = Number.parseInt(hexMapped[2] as string, 16);
+    const octets = [high >> 8, high & 0xff, low >> 8, low & 0xff];
+    return isBlockedIPv4(octets);
+  }
+
+  if (/^fe[89ab][0-9a-f]:/.test(address)) return true; // link-local
+  if (/^f[cd][0-9a-f]{2}:/.test(address)) return true; // unique local
+  if (/^ff[0-9a-f]{2}:/.test(address)) return true; // multicast
+  return false;
+}
+
+/** Whether this hostname is one the server must never be told to fetch. */
+export function isBlockedHostname(hostname: string): boolean {
+  const host = hostname.toLowerCase().replace(/\.$/, "");
+  if (host === "") return true;
+  if (BLOCKED_HOSTNAMES.has(host)) return true;
+  if (BLOCKED_SUFFIXES.some((suffix) => host.endsWith(suffix))) return true;
+
+  const v4 = parseIPv4(host);
+  if (v4 !== null) return isBlockedIPv4(v4);
+  if (host.includes(":")) return isBlockedIPv6(host);
+  return false;
+}
+
+/**
+ * Validate a webhook endpoint.
+ *
+ * Used both when an administrator saves a destination and again on every hop
+ * of the actual request — a URL that was fine at save time can redirect
+ * somewhere that is not.
+ */
+export function checkWebhookUrl(raw: string): UrlCheck {
+  const input = (raw ?? "").trim();
+  if (input === "")
+    return { ok: false, reason: "not-a-url", message: "Enter an endpoint." };
+  if (input.length > MAX_URL_LENGTH) {
+    return {
+      ok: false,
+      reason: "too-long",
+      message: "That endpoint is too long.",
+    };
+  }
+
+  let url: URL;
+  try {
+    url = new URL(input);
+  } catch {
+    return {
+      ok: false,
+      reason: "not-a-url",
+      message: "That is not a valid URL.",
+    };
+  }
+
+  if (url.protocol !== "https:") {
+    return {
+      ok: false,
+      reason: "not-https",
+      message:
+        "The endpoint must start with https:// — an unencrypted webhook would expose the data it carries.",
+    };
+  }
+  if (url.username !== "" || url.password !== "") {
+    return {
+      ok: false,
+      reason: "has-credentials",
+      message:
+        "Remove the username and password from the URL. Use the signing secret instead.",
+    };
+  }
+  if (isBlockedHostname(url.hostname)) {
+    const looksLikeIp =
+      parseIPv4(url.hostname) !== null || url.hostname.includes(":");
+    return {
+      ok: false,
+      reason: looksLikeIp ? "blocked-ip" : "blocked-host",
+      message:
+        "That address is inside this server's own network. A webhook must point at a public endpoint.",
+    };
+  }
+
+  return { ok: true, url };
+}

package/src/types/css-modules.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Side-effect stylesheet imports (the popup package's admin.css). The bundler
+ * that consumes this source understands them natively; this declaration only
+ * teaches the package's own typechecker that they exist.
+ */
+declare module "*.css";