@goodandready/dsh-goal 0.2.24 → 0.2.25

package/lib/routes.js

@@ -8,25 +8,63 @@ import { parseIssueChecklist } from './engine-issue-sync.js';
 
 export function isLoopback(value) {
   if (!value) return false;
-  const address = String(value).toLowerCase().replace(/^\[|\]$/g, '');
+  let address = String(value).toLowerCase().replace(/^\[|\]$/g, '');
+  if (address.includes(':')) {
+    const colons = address.split(':').length - 1;
+    if (colons === 1) address = address.split(':')[0];
+  }
+  address = address.replace(/^::ffff:/, '');
   return Boolean(
     address === 'localhost' ||
     address === 'localhost.' ||
     address === '::1' ||
-    address.startsWith('127.') ||
-    address.startsWith('::ffff:127.')
+    address.startsWith('127.')
   );
 }
 
+export function isTrustedHost(val) {
+  if (!val || typeof val !== 'string') return false;
+  let hostname = val.trim().toLowerCase();
+  if (hostname.startsWith('[')) {
+    const end = hostname.indexOf(']');
+    if (end > 0) hostname = hostname.slice(1, end);
+  } else if (hostname.includes(':')) {
+    const colons = hostname.split(':').length - 1;
+    if (colons === 1) hostname = hostname.split(':')[0];
+  }
+  const clean = hostname.replace(/^::ffff:/, '');
+  if (clean === 'localhost' || clean === 'localhost.' || clean.endsWith('.local') || clean.endsWith('.lan')) return true;
+  if (clean === '127.0.0.1' || clean === '::1' || clean.startsWith('127.')) return true;
+  if (clean.startsWith('10.') || clean.startsWith('192.168.')) return true;
+  const match172 = clean.match(/^172\.(\d+)\./);
+  if (match172) {
+    const octet = parseInt(match172[1], 10);
+    if (octet >= 16 && octet <= 31) return true;
+  }
+  return false;
+}
+
 export function isTrustedCaller(req, authToken = process.env.DSH_GOAL_AUTH_TOKEN) {
   if (!req) return false;
-  const remote = req.socket?.remoteAddress || req.connection?.remoteAddress || "";
+  const rawRemote = req.socket?.remoteAddress || req.connection?.remoteAddress || "";
+  const cleanRemote = String(rawRemote).trim().toLowerCase().replace(/^::ffff:/, '');
   const site = req.headers?.["sec-fetch-site"];
 
   // 1. Cross-site and same-site browser requests are rejected
   if (site === "cross-site" || site === "same-site") return false;
 
-  // Optional authorization token check (supports x-dsh-auth-token or Authorization: Bearer <token>)
+  // 2. If remoteAddress is present, it must be a trusted local/private IP (never untrusted WAN)
+  if (cleanRemote && !isTrustedHost(cleanRemote)) {
+    return false;
+  }
+
+  // 3. If Host header is present, it must be a trusted local/private host (DNS rebinding guard)
+  const host = String(req.headers?.host || "").trim().toLowerCase();
+  if (host && !isTrustedHost(host)) {
+    return false;
+  }
+
+  // 4. Optional authorization token check (supports x-dsh-auth-token or Authorization: Bearer <token>)
   if (authToken) {
     const headerVal = req.headers?.["x-dsh-auth-token"] || req.headers?.authorization;
     const cleanHeader = headerVal ? String(headerVal).replace(/^Bearer\s+/i, "").trim() : "";
@@ -34,18 +72,18 @@ export function isTrustedCaller(req, authToken = process.env.DSH_GOAL_AUTH_TOKEN
       return true;
     }
     // When authToken is explicitly configured, non-loopback callers without valid token are rejected
-    if (!isLoopback(remote)) {
+    if (!isLoopback(cleanRemote)) {
       return false;
     }
   }
 
-  // 2. Same-origin browser UI requests (operator UI on LAN or localhost)
+  // 5. Same-origin browser UI requests (operator UI on LAN or localhost)
   if (site === "same-origin") {
-    const host = String(req.headers?.host || "").toLowerCase();
     const origin = String(req.headers?.origin || "").trim().toLowerCase();
     if (origin && host) {
       try {
         const u = new URL(origin);
+        if (!isTrustedHost(u.hostname)) return false;
         if (u.host === host) return true;
       } catch (err) {
         return false;
@@ -55,6 +93,7 @@ export function isTrustedCaller(req, authToken = process.env.DSH_GOAL_AUTH_TOKEN
     if (referer && host) {
       try {
         const u = new URL(referer);
+        if (!isTrustedHost(u.hostname)) return false;
         if (u.host === host) return true;
       } catch (err) {
         return false;
@@ -63,12 +102,12 @@ export function isTrustedCaller(req, authToken = process.env.DSH_GOAL_AUTH_TOKEN
     return false;
   }
 
-  // 3. No declared site: only loopback remote clients (CLI, reverse proxy) are trusted
-  if (isLoopback(remote)) return true;
+  // 6. No declared site: only loopback remote clients (CLI, reverse proxy) are trusted
+  if (isLoopback(cleanRemote)) return true;
 
-  // 4. Fallback for test harnesses without remote socket where host header explicitly targets loopback
-  if (!remote && req.headers?.host) {
-    const hostName = String(req.headers.host).split(":")[0];
+  // 7. Fallback for test harnesses without remote socket where host header explicitly targets loopback
+  if (!cleanRemote && host) {
+    const hostName = host.split(":")[0];
     if (isLoopback(hostName)) {
       return true;
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-goal",
-  "version": "0.2.24",
+  "version": "0.2.25",
   "description": "Core Goal Addon (Token Budget, Milestones, Git Snapshots & Retrospective Reports) for DeepSeek Harness",
   "type": "module",
   "main": "./lib/index.js",