@goodandready/dsh-github-ops 0.2.10 → 0.2.11

package/CHANGELOG.md

@@ -1,5 +1,13 @@
 # Changelog
 
+## 0.2.11
+
+### Security
+- **Strict CSRF & Origin Verification on SCM Writes** (#98, #81, #99): Added `isTrustedWriteRequest` guarding `POST /scm`. Discarded client-supplied `X-Forwarded-Host` in favor of validated `Host` header. Enforced strict fail-closed policy on cross-site requests (`Sec-Fetch-Site: cross-site`) across loopback and local networks.
+- **Path Segment Encoding & Traversal Defense** (#87): Added `encodeRepoPath` to prevent directory traversal (`..`) and URI-encode path segments in GitHub Contents API endpoints (`getFile`, `deleteFile`, and blob viewer route).
+- **Mirror Publication Isolation & Option Injection Defense** (#83, #91): Added strict validation on mirror destination URLs and branch names (`validateRemote`, `validateBranchName`) to reject leading hyphen flags and CLI option injection into git arguments. Replaced predictable temp index paths with `crypto.randomUUID()`-backed paths in `tmpdir()`.
+- **Release Asset Upload Workspace Containment** (#82): Restricted release asset file uploads to files within the workspace root or allowlisted local files, rejecting system directories (`/etc`, `/proc`, `/sys`, etc.), traversal paths, and control characters.
+
 ## 0.2.10
 
 ### Fixed

package/lib/github.js

@@ -424,3 +424,17 @@ export function describeError(err) {
   }
   return String(err.message || err)
 }
+
+/**
+ * Safely encode a repository file path segment for the GitHub contents API.
+ * Rejects path traversal (..) and encodes each path component.
+ */
+export function encodeRepoPath(rawPath) {
+  const cleaned = String(rawPath == null ? '' : rawPath).trim().replace(/^\/+/, '')
+  if (!cleaned) throw new Error('path is required')
+  const segments = cleaned.split('/')
+  if (segments.some((s) => s === '..' || s === '.')) {
+    throw new Error('path must not contain traversal segments')
+  }
+  return segments.map(encodeURIComponent).join('/')
+}

package/lib/index.js

@@ -375,7 +375,7 @@ export function apply(ctx, rawConfig) {
     },
   }
 
-  const deps = { tool, asRepo, client, liveConfig, reviewRules, auth: authSeam }
+  const deps = { tool, asRepo, client, liveConfig, reviewRules, auth: authSeam, defaultCwd: () => (typeof ctx.cwd === 'string' && ctx.cwd) || process.cwd() }
   registerCoreTools(deps)
   registerCollabTools(deps)
   registerOpsTools(deps)

package/lib/routes.js

@@ -8,7 +8,7 @@
 import { existsSync, statSync } from 'node:fs'
 import { join as joinPath } from 'node:path'
 
-import { statusPayload, isTrustedRequest, sendJson } from './status.js'
+import { statusPayload, isTrustedRequest, isTrustedWriteRequest, sendJson } from './status.js'
 import { buildAction, validateCwd } from './scm-write.js'
 import { parseStatus, parseBranches, parseStashes, parseWorktrees, parseCount, scmPayload, mergeStateFrom } from './scm.js'
 import { listIssues } from './tools/issues.js'
@@ -94,7 +94,11 @@ export function registerRoutes(ctx, deps = {}) {
         path: SCM_PATH,
         handler: async (req, res) => {
           if (req.method !== 'GET' && req.method !== 'POST') return sendJson(res, 405, { error: 'method not allowed' })
-          if (!isTrustedRequest(req)) return sendJson(res, 403, { error: 'forbidden' })
+          if (req.method === 'POST') {
+            if (!isTrustedWriteRequest(req)) return sendJson(res, 403, { error: 'forbidden' })
+          } else {
+            if (!isTrustedRequest(req)) return sendJson(res, 403, { error: 'forbidden' })
+          }
           const git = makeGitRunner()
           const url = new URL(req.url || '/', 'http://localhost')
           const file = url.searchParams.get('file') || ''
@@ -254,7 +258,13 @@ export function registerRoutes(ctx, deps = {}) {
               return sendJson(res, 200, { configured: true, ...view })
             }
             if (what === 'blob') {
-              const { data } = await github.get(`/repos/${repoOwner}/${repoName}/contents/${path}`, { query: ref ? { ref } : undefined })
+              let encodedPath = ''
+              try {
+                encodedPath = encodeRepoPath(path)
+              } catch (err) {
+                return sendJson(res, 400, { configured: true, error: (err && err.message) || String(err) })
+              }
+              const { data } = await github.get(`/repos/${repoOwner}/${repoName}/contents/${encodedPath}`, { query: ref ? { ref } : undefined })
               if (Array.isArray(data)) return sendJson(res, 200, { configured: true, entries: data.map((e) => ({ name: e.name, type: e.type, size: e.size, path: e.path })) })
               const encoded = String((data && data.content) || '').replace(/\n/g, '')
               const text = encoded ? Buffer.from(encoded, 'base64').toString('utf8') : ''

package/lib/status.js

@@ -7,43 +7,97 @@
 // The payload never contains the access value. The route answers only a local or same-origin
 // caller, because the payload describes the machine's account.
 
+/** Whether a request may read the status payload. Fail-closed. */
+function isTrustedHost(host) {
+  if (!host || typeof host !== 'string') return false
+  let hostname = host.trim()
+  if (hostname.startsWith('[')) {
+    const end = hostname.indexOf(']')
+    if (end > 0) hostname = hostname.slice(1, end)
+  } else {
+    hostname = hostname.split(':')[0]
+  }
+  hostname = hostname.toLowerCase()
+  if (!hostname) return false
+  if (hostname === 'localhost' || hostname.endsWith('.local') || hostname.endsWith('.lan')) return true
+  const clean = hostname.replace(/^::ffff:/, '')
+  if (clean === '127.0.0.1' || clean === '::1' || clean.startsWith('127.')) return true
+  if (clean.startsWith('10.') || clean.startsWith('192.168.')) return true
+  const match172 = clean.match(/^172\.(\d+)\./)
+  if (match172) {
+    const octet = parseInt(match172[1], 10)
+    if (octet >= 16 && octet <= 31) return true
+  }
+  return false
+}
+
 /** Whether a request may read the status payload. Fail-closed. */
 export function isTrustedRequest(req) {
   if (!req) return false
-  const address = (req.socket && (req.socket.remoteAddress || req.socket.address?.().address)) || ''
-  const loopback = address === '127.0.0.1' || address === '::1' || address === '::ffff:127.0.0.1'
-  if (loopback) return true
 
-  // For non-loopback callers: fail-closed source verification
+  // Fail-closed against cross-site fetches regardless of source IP
   const secFetchSite = header(req, 'sec-fetch-site')
   if (secFetchSite === 'cross-site') return false
 
-  const host = header(req, 'x-forwarded-host') || header(req, 'host')
+  const address = (req.socket && (req.socket.remoteAddress || req.socket.address?.().address)) || ''
+  const cleanIp = address.replace(/^::ffff:/, '')
+  const loopback = cleanIp === '127.0.0.1' || cleanIp === '::1' || cleanIp.startsWith('127.')
+
+  const host = header(req, 'host')
   const origin = header(req, 'origin') || header(req, 'referer')
-  if (!host || !origin) return false
 
-  try {
-    const originUrl = new URL(origin)
-    if (originUrl.host.toLowerCase() !== host.toLowerCase()) return false
+  // If host is provided, it MUST be a trusted local/private host (DNS rebinding guard)
+  if (host && !isTrustedHost(host)) return false
+
+  // If browser headers (origin/referer/sec-fetch-site) are absent and caller is loopback, allow local caller
+  if (!origin && !secFetchSite && loopback) return true
 
+  // If origin/referer is present, verify it matches host or is a trusted local host
+  if (origin) {
+    try {
+      const originUrl = new URL(origin)
+      if (!isTrustedHost(originUrl.hostname)) return false
+      if (host && originUrl.host.toLowerCase() !== host.toLowerCase()) return false
+      return true
+    } catch {
+      return false
+    }
+  }
 
+  // Non-loopback caller without origin/referer is refused
+  if (!loopback) return false
 
-    // DNS rebinding guard: host must be a loopback, local or private LAN address
-    const hostname = host.split(':')[0].toLowerCase()
-    const isPrivate =
-      hostname === 'localhost' ||
-      hostname === '127.0.0.1' ||
-      hostname === '::1' ||
-      /^192\.168\.\d{1,3}\.\d{1,3}$/.test(hostname) ||
-      /^10\.\d{1,3}\.\d{1,3}\.\d{1,3}$/.test(hostname) ||
-      /^172\.(1[6-9]|2\d|3[0-1])\.\d{1,3}\.\d{1,3}$/.test(hostname) ||
-      hostname.endsWith('.local') ||
-      hostname.endsWith('.lan')
+  return true
+}
 
-    return isPrivate
-  } catch {
+/** Whether a write/mutating request (e.g. POST /scm) is safe. Strict write guard against CSRF. */
+export function isTrustedWriteRequest(req) {
+  if (!req) return false
+  if (!isTrustedRequest(req)) return false
+
+  const secFetchSite = header(req, 'sec-fetch-site')
+  if (secFetchSite && secFetchSite !== 'same-origin' && secFetchSite !== 'none') {
     return false
   }
+
+  const host = header(req, 'host')
+  const origin = header(req, 'origin') || header(req, 'referer')
+  if (origin) {
+    try {
+      const originUrl = new URL(origin)
+      if (host && originUrl.host.toLowerCase() !== host.toLowerCase()) return false
+    } catch {
+      return false
+    }
+  } else {
+    // Write request without origin: only permit local loopback
+    const address = (req.socket && (req.socket.remoteAddress || req.socket.address?.().address)) || ''
+    const cleanIp = address.replace(/^::ffff:/, '')
+    const loopback = cleanIp === '127.0.0.1' || cleanIp === '::1' || cleanIp.startsWith('127.')
+    if (!loopback) return false
+  }
+
+  return true
 }
 
 function header(req, name) {

package/lib/tools/mirror.js

@@ -1,3 +1,6 @@
+import { randomUUID } from 'node:crypto'
+import { tmpdir } from 'node:os'
+import path from 'node:path'
 // Sanitized mirror publication.
 //
 // A GitHub mirror is a product channel, not a copy of the history: only the npm
@@ -76,7 +79,30 @@ async function readManifest(git, { cwd, ref }) {
  * Read-only plan: which files would be published, how many would be left behind, and
  * whether the publication must be refused (forbidden path present, required file missing).
  */
+
+const REMOTE_NAME_RE = /^(?!-)[a-zA-Z0-9._/-]+$/
+const BRANCH_NAME_RE = /^(?!-)[a-zA-Z0-9._/-]+$/
+
+export function validateRemote(remote) {
+  const val = String(remote || '').trim()
+  if (!val || val.startsWith('-') || !REMOTE_NAME_RE.test(val)) {
+    throw new Error(`invalid mirror remote name: "${remote}"`)
+  }
+  return val
+}
+
+export function validateBranchName(branch) {
+  const val = String(branch || '').trim()
+  if (!val || val.startsWith('-') || !BRANCH_NAME_RE.test(val)) {
+    throw new Error(`invalid branch name: "${branch}"`)
+  }
+  return val
+}
+
 export async function planMirror({ git, cwd, ref = 'origin/main', allow, forbidden, required = DEFAULT_REQUIRED }) {
+  if (String(ref || '').trim().startsWith('-')) {
+    throw new Error(`invalid source ref: "${ref}"`)
+  }
   const manifest = await readManifest(git, { cwd, ref })
   const allowlist = allow || allowlistFromManifest(manifest)
   const ls = await git(['ls-tree', '-r', '--name-only', ref], { cwd })
@@ -115,6 +141,11 @@ export async function publishMirror({
   git, cwd, ref = 'origin/main', mirror = 'github', branch = 'main',
   allow, forbidden, required = DEFAULT_REQUIRED, dryRun = false, message,
 }) {
+  validateRemote(mirror)
+  validateBranchName(branch)
+  if (String(ref || '').trim().startsWith('-')) {
+    throw new Error(`invalid source ref: "${ref}"`)
+  }
   const plan = await planMirror({ git, cwd, ref, allow, forbidden, required })
   if (plan.refused) {
     const err = new Error(plan.refused)
@@ -131,7 +162,7 @@ export async function publishMirror({
 
   if (dryRun) return { ...plan, mirror: mirrorRef, parent, commit: null, pushed: false }
 
-  const indexFile = `/tmp/dsh-github-ops-mirror-${process.pid}-${Date.now()}.index`
+  const indexFile = path.join(tmpdir(), `dsh-mirror-${process.pid}-${randomUUID()}.index`)
   const env = { GIT_INDEX_FILE: indexFile }
   try {
     await git(['read-tree', '--empty'], { cwd, env })

package/lib/tools/register-core.js

@@ -14,7 +14,7 @@ const REPOSITORY = {
   repository: { type: 'string', description: 'Repository as "owner/repo". Omit to use the default from settings.' },
 }
 
-export function registerCoreTools({ tool, asRepo, client, liveConfig }) {
+export function registerCoreTools({ tool, asRepo, client, liveConfig, defaultCwd }) {
   const repoParams = (extra = {}) => ({ ...REPOSITORY, ...extra })
 
   // ------------------------------------------------------------------ repository
@@ -223,6 +223,7 @@ export function registerCoreTools({ tool, asRepo, client, liveConfig }) {
         name: args.name,
         label: args.label,
         contentType: args.contentType,
+        cwd: typeof defaultCwd === 'function' ? defaultCwd() : undefined,
       })
     },
   )

package/lib/tools/releases.js

@@ -139,23 +139,61 @@ export async function listReleaseAssets(client, { owner, repo, tag, releaseId, l
   return { assets, count: assets.length, releaseId: id, rateLimit }
 }
 
-export async function uploadReleaseAsset(client, { owner, repo, tag, releaseId, filePath, name, label, contentType }) {
+const DISALLOWED_ROOTS = ['/etc', '/proc', '/sys', '/dev', '/root', '/bin', '/sbin', '/usr', '/boot', '/var/run']
+
+function checkDisallowedRoots(resolvedPath, sep) {
+  for (const root of DISALLOWED_ROOTS) {
+    if (resolvedPath === root || resolvedPath.startsWith(root + sep) || resolvedPath.startsWith(root + '/')) {
+      throw new Error(`access to system directory "${root}" is not allowed`)
+    }
+  }
+}
+
+export async function uploadReleaseAsset(client, { owner, repo, tag, releaseId, filePath, name, label, contentType, cwd }) {
   ensureRepo({ owner, repo })
-  if (!filePath) throw new Error('filePath is required')
-  const id = await resolveReleaseId(client, { owner, repo, tag, releaseId })
+  if (!filePath || typeof filePath !== 'string') throw new Error('filePath is required')
+  if (/[\x00-\x1f]/.test(filePath)) throw new Error('filePath may not contain control characters')
 
   const fs = await import('node:fs/promises')
   const path = await import('node:path')
 
+  const baseDir = cwd ? path.resolve(cwd) : null
+  const resolvedPath = baseDir ? path.resolve(baseDir, filePath) : path.resolve(filePath)
+
+  if (baseDir) {
+    if (resolvedPath !== baseDir && !resolvedPath.startsWith(baseDir + path.sep)) {
+      throw new Error(`filePath must reside within the workspace directory: ${filePath}`)
+    }
+  }
+
+  checkDisallowedRoots(resolvedPath, path.sep)
+
+  let realTarget = resolvedPath
+  try {
+    realTarget = await fs.realpath(resolvedPath)
+  } catch (err) {
+    throw new Error(`cannot access file "${filePath}": ${err && err.message}`)
+  }
+
+  checkDisallowedRoots(realTarget, path.sep)
+
+  if (baseDir) {
+    const realBase = await fs.realpath(baseDir).catch(() => baseDir)
+    if (realTarget !== realBase && !realTarget.startsWith(realBase + path.sep)) {
+      throw new Error(`filePath must reside within the workspace directory: ${filePath}`)
+    }
+  }
+
   let stats
   try {
-    stats = await fs.stat(filePath)
+    stats = await fs.stat(realTarget)
   } catch (err) {
     throw new Error(`cannot access file "${filePath}": ${err && err.message}`)
   }
   if (!stats.isFile()) throw new Error(`"${filePath}" is not a file`)
 
-  const fileBuffer = await fs.readFile(filePath)
+  const id = await resolveReleaseId(client, { owner, repo, tag, releaseId })
+  const fileBuffer = await fs.readFile(realTarget)
   const assetName = name || path.basename(filePath)
   const mimeType = contentType || 'application/octet-stream'
 

package/lib/tools/repos.js

@@ -1,3 +1,4 @@
+import { encodeRepoPath } from '../github.js'
 // Repository and file operations: metadata, file content at a ref, repository
 // search (its own quota), plus repository creation and edits.
 
@@ -36,8 +37,8 @@ export async function getRepo(client, { owner, repo }) {
 
 export async function getFile(client, { owner, repo, path, ref }) {
   ensureRepo({ owner, repo })
-  if (!path) throw new Error('path is required')
-  const { data } = await client.get(`/repos/${owner}/${repo}/contents/${path}`, {
+  const encodedPath = encodeRepoPath(path)
+  const { data } = await client.get(`/repos/${owner}/${repo}/contents/${encodedPath}`, {
     query: ref ? { ref } : undefined,
   })
   if (Array.isArray(data)) {

package/lib/tools/write-files.js

@@ -1,3 +1,4 @@
+import { encodeRepoPath } from '../github.js'
 // Writing files without a local checkout.
 //
 // A commit is built the way git builds it: blobs, a tree on top of the branch's tree, a
@@ -185,14 +186,14 @@ export async function uploadProject(client, {
 /** Delete one file, resolving its blob sha first (the contents API requires it). */
 export async function deleteFile(client, { owner, repo, path, message, branch } = {}) {
   ensureRepo({ owner, repo })
-  if (!path) throw new Error('path is required')
   if (!message) throw new Error('message is required')
-  const { data: current } = await client.get(`/repos/${owner}/${repo}/contents/${String(path).replace(/^\/+/, '')}`, {
+  const encodedPath = encodeRepoPath(path)
+  const { data: current } = await client.get(`/repos/${owner}/${repo}/contents/${encodedPath}`, {
     query: branch ? { ref: branch } : undefined,
   })
   const sha = current && current.sha
   if (!sha) throw new Error(`cannot resolve ${path}`)
-  const { data } = await client.del(`/repos/${owner}/${repo}/contents/${String(path).replace(/^\/+/, '')}`, {
+  const { data } = await client.del(`/repos/${owner}/${repo}/contents/${encodedPath}`, {
     body: { message, sha, ...(branch ? { branch } : {}) },
   })
   return { deleted: true, path, commit: data && data.commit ? data.commit.sha : null }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-github-ops",
-  "version": "0.2.10",
+  "version": "0.2.11",
   "description": "GitHub operations for DeepSeek Harness: releases, tags, a guarded generic API pass-through, workflow runs, secrets and sanitized mirror publication.",
   "license": "MIT",
   "type": "module",