@goodandready/dsh-image-gen 0.10.30 → 0.10.31

package/lib/index.js

@@ -15,7 +15,7 @@
 import z from '@deepseek-ai/schemastery'
 import { credentialRef } from '@deepseek-ai/dsh-credentials'
 import { mkdir, readFile, writeFile } from 'node:fs/promises'
-import { enforceSecurePermissions } from './security.js'
+import { enforceSecurePermissions, isTrustedLocalRequest } from './security.js'
 import { saveAndAttachResult } from './attachment-helper.js'
 import {
   historyFile,
@@ -431,6 +431,11 @@ export function apply(ctx, config) {
         res.end(JSON.stringify({ error: 'GET only' }))
         return
       }
+      if (!isTrustedLocalRequest(req)) {
+        res.writeHead(403, { 'Content-Type': 'application/json' })
+        res.end(JSON.stringify({ error: 'forbidden' }))
+        return
+      }
       const query = new URL(req.url ?? '/', 'http://x').searchParams
       const id = query.get('id') ?? ''
       if (!/^sha256:[0-9a-f]{64}$/.test(id)) {
@@ -504,6 +509,11 @@ export function apply(ctx, config) {
         res.end(JSON.stringify({ error: 'GET only' }))
         return
       }
+      if (!isTrustedLocalRequest(req)) {
+        res.writeHead(403, { 'Content-Type': 'application/json' })
+        res.end(JSON.stringify({ error: 'forbidden' }))
+        return
+      }
       try {
         const u = new URL(req.url, 'http://localhost')
         const provider = u.searchParams.get('provider') || config.provider || 'fal'
@@ -533,12 +543,20 @@ export function apply(ctx, config) {
         res.end(JSON.stringify({ error: 'GET only' }))
         return
       }
+      if (!isTrustedLocalRequest(req)) {
+        res.writeHead(403, { 'Content-Type': 'application/json' })
+        res.end(JSON.stringify({ error: 'forbidden' }))
+        return
+      }
       const exists = (p) => existsSync(p)
       const entries = await readHistory()
-      const withThumbs = filterHistory(entries, exists).map((e) => ({
-        ...e,
-        thumbnailUrl: e.attachmentId ? `/dsh-image-gen/image?id=${encodeURIComponent(e.attachmentId)}` : '',
-      }))
+      const withThumbs = filterHistory(entries, exists).map((e) => {
+        const { path: _discardPath, ...safeEntry } = e
+        return {
+          ...safeEntry,
+          thumbnailUrl: e.attachmentId ? `/dsh-image-gen/image?id=${encodeURIComponent(e.attachmentId)}` : '',
+        }
+      })
       res.writeHead(200, { 'Content-Type': 'application/json' })
       res.end(JSON.stringify(withThumbs))
     },

package/lib/security.js

@@ -1,5 +1,6 @@
 // lib/security.js
 // Secure credential handling, 0600 file permissions, and token masking (#169)
+// Address validation and trusted request guards against DNS rebinding & cross-site leaks (Refs: GitHub #1, #280, #276, #277)
 
 import { chmodSync, existsSync } from 'node:fs'
 
@@ -67,3 +68,168 @@ export function enforceSecurePermissions(filePath) {
     return false
   }
 }
+
+/**
+ * Strict loopback address verification.
+ * Supports:
+ * - 'localhost' and RFC 6761 reserved '.localhost' TLD (e.g. 'sub.localhost')
+ * - IPv6 loopback '::1'
+ * - Strict IPv4 loopback 127.0.0.0/8 (anchored ^ and $, valid octets 0..255)
+ * - IPv6-mapped IPv4 loopback '::ffff:127.x.x.x'
+ *
+ * Explicitly rejects prefix-matched hostnames such as 127.0.0.1.evil.com.
+ */
+export function isLoopbackAddress(value) {
+  if (!value || typeof value !== 'string') return false
+  const address = value.trim().toLowerCase().replace(/^\[|\]$/g, '')
+  if (
+    address === 'localhost' ||
+    address === 'localhost.' ||
+    address === '::1' ||
+    address.endsWith('.localhost') ||
+    address.endsWith('.localhost.')
+  ) {
+    return true
+  }
+  const ipv4 = address.startsWith('::ffff:') ? address.slice(7) : address
+  const m = /^127\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/.exec(ipv4)
+  if (!m) return false
+  const o = [Number(m[1]), Number(m[2]), Number(m[3])]
+  return o.every((n) => n >= 0 && n <= 255)
+}
+
+/**
+ * Strict private LAN address verification.
+ * Supports:
+ * - 10.0.0.0/8 (10.0.0.0 - 10.255.255.255)
+ * - 172.16.0.0/12 (172.16.0.0 - 172.31.255.255)
+ * - 192.168.0.0/16 (192.168.0.0 - 192.168.255.255)
+ * - 169.254.0.0/16 (link-local)
+ * - IPv6-mapped IPv4 equivalents (::ffff:...)
+ * - IPv6 ULA (fc00::/7) and link-local (fe80::/10)
+ *
+ * Explicitly rejects prefix-matched hostnames such as 10.evil.com,
+ * 192.168.evil.com, 172.16.evil.com, 10.0.0.1.nip.io.
+ */
+export function isPrivateLanAddress(value) {
+  if (!value || typeof value !== 'string') return false
+  const address = value.trim().toLowerCase().replace(/^\[|\]$/g, '')
+  const ipv4 = address.startsWith('::ffff:') ? address.slice(7) : address
+  const m = /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/.exec(ipv4)
+  if (m) {
+    const o = [Number(m[1]), Number(m[2]), Number(m[3]), Number(m[4])]
+    if (o.some((n) => n < 0 || n > 255)) return false
+    if (o[0] === 10) return true
+    if (o[0] === 172 && o[1] >= 16 && o[1] <= 31) return true
+    if (o[0] === 192 && o[1] === 168) return true
+    if (o[0] === 169 && o[1] === 254) return true
+    return false
+  }
+
+  // IPv6 ULA (fc00::/7) or link-local (fe80::/10)
+  if (/^(fc|fd)[0-9a-f]{2}:/i.test(address) || /^fe80:/i.test(address)) {
+    return true
+  }
+
+  return false
+}
+
+/**
+ * Safely extracts hostname without port or IPv6 brackets from Host header or authority string.
+ */
+export function extractHostName(hostHeader) {
+  if (!hostHeader || typeof hostHeader !== 'string') return ''
+  const trimmed = hostHeader.trim()
+  try {
+    const url = new URL(`http://${trimmed}`)
+    return url.hostname.replace(/^\[|\]$/g, '')
+  } catch {
+    return trimmed.replace(/^\[|\]$/g, '').split(':')[0] || ''
+  }
+}
+
+/**
+ * Helper to get header value in case-insensitive manner.
+ */
+function getHeader(req, name) {
+  if (!req?.headers) return undefined
+  const direct = req.headers[name]
+  if (direct !== undefined) return Array.isArray(direct) ? direct[0] : direct
+  const lower = req.headers[name.toLowerCase()]
+  return Array.isArray(lower) ? lower[0] : lower
+}
+
+/**
+ * Verifies that an incoming HTTP request originates from and targets a trusted local or private LAN authority.
+ * Guards against DNS rebinding, cross-site leaks, and unauthorized external probing.
+ *
+ * Rules:
+ * 1. Client remote address (if present on socket) must be loopback or private LAN.
+ * 2. Sec-Fetch-Site (if present) must NOT be 'cross-site'.
+ * 3. Host header must be present and its hostname must be loopback or private LAN.
+ * 4. Origin header (if present) must have valid http/https protocol, its hostname must be loopback/LAN,
+ *    and its host authority must match the request's Host header.
+ * 5. Referer header (if present) must have valid http/https protocol and its hostname must be loopback/LAN.
+ */
+export function isTrustedLocalRequest(req) {
+  if (!req) return false
+
+  const remote = req.socket?.remoteAddress
+  if (remote && !isLoopbackAddress(remote) && !isPrivateLanAddress(remote)) {
+    return false
+  }
+
+  const site = getHeader(req, 'sec-fetch-site')
+  if (site === 'cross-site') {
+    return false
+  }
+
+  const host = getHeader(req, 'host')
+  if (!host || typeof host !== 'string') {
+    return false
+  }
+  const hostName = extractHostName(host)
+  if (!isLoopbackAddress(hostName) && !isPrivateLanAddress(hostName)) {
+    return false
+  }
+
+  const origin = getHeader(req, 'origin')
+  if (origin !== undefined) {
+    if (typeof origin !== 'string' || origin === '' || origin === 'null') {
+      return false
+    }
+    try {
+      const url = new URL(origin)
+      if (url.protocol !== 'http:' && url.protocol !== 'https:') {
+        return false
+      }
+      const originHostName = url.hostname.replace(/^\[|\]$/g, '')
+      if (!isLoopbackAddress(originHostName) && !isPrivateLanAddress(originHostName)) {
+        return false
+      }
+      if (url.host.toLowerCase() !== host.toLowerCase()) {
+        return false
+      }
+    } catch {
+      return false
+    }
+  }
+
+  const referer = getHeader(req, 'referer')
+  if (referer !== undefined && typeof referer === 'string' && referer !== '') {
+    try {
+      const url = new URL(referer)
+      if (url.protocol !== 'http:' && url.protocol !== 'https:') {
+        return false
+      }
+      const refererHostName = url.hostname.replace(/^\[|\]$/g, '')
+      if (!isLoopbackAddress(refererHostName) && !isPrivateLanAddress(refererHostName)) {
+        return false
+      }
+    } catch {
+      return false
+    }
+  }
+
+  return true
+}

package/lib/updater.js

@@ -4,6 +4,7 @@ import { readFile } from 'node:fs/promises'
 import { homedir } from 'node:os'
 import { basename, dirname, isAbsolute, resolve } from 'node:path'
 import { fileURLToPath } from 'node:url'
+import { isLoopbackAddress, isPrivateLanAddress, extractHostName } from './security.js'
 
 /**
  * Host-side one-click updater for @goodandready/dsh-image-gen.
@@ -21,31 +22,17 @@ function header(request, name) {
 }
 
 function isLoopback(value) {
-  const address = value?.toLowerCase().replace(/^\[|\]$/g, '')
-  return (
-    address === 'localhost' ||
-    address === 'localhost.' ||
-    address === '::1' ||
-    address?.startsWith('127.') === true ||
-    address?.startsWith('::ffff:127.') === true
-  )
+  return isLoopbackAddress(value)
 }
 
 function isPrivateLan(value) {
-  const address = value?.toLowerCase().replace(/^\[|\]$/g, '')
-  if (!address) return false
-  const ipv4 = address.startsWith('::ffff:') ? address.slice(7) : address
-  return (
-    ipv4.startsWith('192.168.') ||
-    ipv4.startsWith('10.') ||
-    /^172\.(1[6-9]|2[0-9]|3[0-1])\./.test(ipv4)
-  )
+  return isPrivateLanAddress(value)
 }
 
 export function isTrustedUpdateRequest(request) {
   if (header(request, UPDATE_HEADER) !== '1') return false
   const remote = request.socket?.remoteAddress
-  if (!isLoopback(remote) && !isPrivateLan(remote)) return false
+  if (!isLoopbackAddress(remote) && !isPrivateLanAddress(remote)) return false
   const site = header(request, 'sec-fetch-site')
   if (site !== undefined && site !== 'same-origin') return false
   const origin = header(request, 'origin')
@@ -53,10 +40,13 @@ export function isTrustedUpdateRequest(request) {
   if (origin === undefined || host === undefined) return false
   try {
     const url = new URL(origin)
+    const originHostName = extractHostName(url.host)
+    const hostName = extractHostName(host)
     return (
       (url.protocol === 'http:' || url.protocol === 'https:') &&
-      (isLoopback(url.hostname) || isPrivateLan(url.hostname)) &&
-      url.host === host
+      (isLoopbackAddress(originHostName) || isPrivateLanAddress(originHostName)) &&
+      (isLoopbackAddress(hostName) || isPrivateLanAddress(hostName)) &&
+      url.host.toLowerCase() === host.toLowerCase()
     )
   } catch {
     return false

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@goodandready/dsh-image-gen",
-  "version": "0.10.30",
-  "description": "Image generation for DeepSeek Harness: a generate_image tool with pluggable providers \u2014 the FAL queue, any OpenAI-compatible images API, or a ChatGPT/Grok subscription with no API key at all. The picture is shown inline in the conversation; the model receives either a link (works with any chat model) or the image itself (needs dsh-vision-bridge or a vision-capable model).",
+  "version": "0.10.31",
+  "description": "Image generation for DeepSeek Harness: a generate_image tool with pluggable providers — the FAL queue, any OpenAI-compatible images API, or a ChatGPT/Grok subscription with no API key at all. The picture is shown inline in the conversation; the model receives either a link (works with any chat model) or the image itself (needs dsh-vision-bridge or a vision-capable model).",
   "keywords": [
     "deepseek-harness",
     "dsh",