@goodandready/dsh-kanban 0.2.27 → 0.2.28

package/lib/index.js

@@ -658,6 +658,8 @@ export function apply(ctx, config) {
     path: '/dsh-kanban/presets',
     // Both services are optional in minimal environments. Empty lists render gracefully.
     handler: async (req, res) => {
+      if (req.method !== 'GET') { writeJson(res, 405, { error: 'method-not-allowed' }); return }
+      if (!isTrustedRequest(req)) { writeJson(res, 403, { error: 'cross-site' }); return }
       const presets = ctx.get('agentPresets')
       const permissions = ctx.get('permissionPresets')
       let agentPresets = []
@@ -694,6 +696,7 @@ export function apply(ctx, config) {
     path: '/dsh-kanban/sessions',
     handler: (req, res) => {
       if (req.method !== 'GET') { writeJson(res, 405, { error: 'method-not-allowed' }); return }
+      if (!isTrustedRequest(req)) { writeJson(res, 403, { error: 'cross-site' }); return }
       reply(res, { sessions: liveSessions({ store, agents: ctx.agents }) })
     },
   }), 'dsh-kanban: live sessions')
@@ -735,6 +738,7 @@ export function apply(ctx, config) {
     path: '/dsh-kanban/archive',
     handler: (req, res) => {
       if (req.method !== 'GET') { writeJson(res, 405, { error: 'method-not-allowed' }); return }
+      if (!isTrustedRequest(req)) { writeJson(res, 403, { error: 'cross-site' }); return }
       reply(res, listArchive({ store }))
     },
   }), 'dsh-kanban: archive')
@@ -840,6 +844,7 @@ export function apply(ctx, config) {
     path: '/dsh-kanban/board',
     handler: (req, res) => {
       if (req.method !== 'GET') { writeJson(res, 405, { error: 'method-not-allowed' }); return }
+      if (!isTrustedRequest(req)) { writeJson(res, 403, { error: 'cross-site' }); return }
       const url = urlOf(req)
       reply(res, buildBoard({
         store,
@@ -874,6 +879,7 @@ export function apply(ctx, config) {
     path: '/dsh-kanban/metrics',
     handler: (req, res) => {
       if (req.method !== 'GET') { writeJson(res, 405, { error: 'method-not-allowed' }); return }
+      if (!isTrustedRequest(req)) { writeJson(res, 403, { error: 'cross-site' }); return }
       const url = urlOf(req)
       const days = Number(url.searchParams.get('staleDays'))
       reply(res, boardMetrics({
@@ -890,6 +896,7 @@ export function apply(ctx, config) {
     // Empty login indicates unconfigured or unreachable Gitea; client omits "Mine" filter.
     handler: async (req, res) => {
       if (req.method !== 'GET') { writeJson(res, 405, { error: 'method-not-allowed' }); return }
+      if (!isTrustedRequest(req)) { writeJson(res, 403, { error: 'cross-site' }); return }
       reply(res, { login: await whoAmI() })
     },
   }), 'dsh-kanban: whoami')
@@ -899,6 +906,7 @@ export function apply(ctx, config) {
     path: '/dsh-kanban/export.csv',
     handler: async (req, res) => {
       if (req.method !== 'GET') { writeJson(res, 405, { error: 'method-not-allowed' }); return }
+      if (!isTrustedRequest(req)) { writeJson(res, 403, { error: 'cross-site' }); return }
       const u = urlOf(req)
       const board = u.searchParams.get('board') || 'main'
       const csv = exportTasksCsv({ store, board })
@@ -931,6 +939,7 @@ export function apply(ctx, config) {
     path: '/dsh-kanban/templates',
     handler: (req, res) => {
       if (req.method !== 'GET') { writeJson(res, 405, { error: 'method-not-allowed' }); return }
+      if (!isTrustedRequest(req)) { writeJson(res, 403, { error: 'cross-site' }); return }
       const u = new URL(req.url, 'http://localhost')
       const tid = u.searchParams.get('id')
       if (tid) {
@@ -947,9 +956,9 @@ export function apply(ctx, config) {
     kind: 'exact',
     path: '/dsh-kanban/snapshot',
     handler: async (req, res) => {
+      if (!isTrustedRequest(req)) { writeJson(res, 403, { error: 'cross-site' }); return }
       if (req.method === 'GET') { reply(res, exportBoard({ store })); return }
       if (req.method !== 'POST') { writeJson(res, 405, { error: 'method-not-allowed' }); return }
-      if (!isTrustedRequest(req)) { writeJson(res, 403, { error: 'cross-site' }); return }
       try {
         const input = await readBody(req)
         const impResult = importBoard({ store, input })
@@ -990,6 +999,8 @@ export function apply(ctx, config) {
       if (parsed === undefined) { writeJson(res, 404, { error: 'not-found' }); return }
       const { id, action } = parsed
 
+      if (!isTrustedRequest(req)) { writeJson(res, 403, { error: 'cross-site' }); return }
+
       if (req.method === 'GET' && action === 'log') { reply(res, taskLog({ store, id })); return }
       if (req.method === 'GET' && action === 'body') { reply(res, taskBody({ store, id })); return }
 
@@ -1000,7 +1011,6 @@ export function apply(ctx, config) {
         writeJson(res, 200, { text: buildStartMessage(task, getConfig()) })
         return
       }
-      if (!isTrustedRequest(req)) { writeJson(res, 403, { error: 'cross-site' }); return }
       if (req.method === 'DELETE' && action === undefined) {
         const resObj = deleteTask({ store, id })
         if (resObj?.deleted) {
@@ -1381,6 +1391,7 @@ export function apply(ctx, config) {
     path: '/dsh-kanban/gitea/repos',
     handler: async (req, res) => {
       if (req.method !== 'GET') { writeJson(res, 405, { error: 'method-not-allowed' }); return }
+      if (!isTrustedRequest(req)) { writeJson(res, 403, { error: 'cross-site' }); return }
       const url = urlOf(req)
       reply(res, await searchRepos({ gitea: git, query: url.searchParams.get('q') || '' }))
     },
@@ -1391,6 +1402,7 @@ export function apply(ctx, config) {
     path: '/dsh-kanban/gitea/issues',
     handler: async (req, res) => {
       if (req.method !== 'GET') { writeJson(res, 405, { error: 'method-not-allowed' }); return }
+      if (!isTrustedRequest(req)) { writeJson(res, 403, { error: 'cross-site' }); return }
       const url = urlOf(req)
       reply(res, await listImportable({
         gitea: git,
@@ -1428,6 +1440,7 @@ export function apply(ctx, config) {
     path: '/dsh-kanban/models',
     handler: async (req, res) => {
       if (req.method !== 'GET') { writeJson(res, 405, { error: 'method-not-allowed' }); return }
+      if (!isTrustedRequest(req)) { writeJson(res, 403, { error: 'cross-site' }); return }
       const current = ctx.get('agentDefaultModel')?.currentSelection?.() ?? null
       const llmService = ctx.get('llm')
       let providers = []
@@ -1456,6 +1469,7 @@ export function apply(ctx, config) {
     path: '/dsh-kanban/session',
     handler: (req, res) => {
       if (req.method !== 'GET') { writeJson(res, 405, { error: 'method-not-allowed' }); return }
+      if (!isTrustedRequest(req)) { writeJson(res, 403, { error: 'cross-site' }); return }
       const m = /^\/dsh-kanban\/session\/([^/]+)\/task\/?$/.exec(urlOf(req).pathname)
       if (m === null) { writeJson(res, 404, { error: 'not-found' }); return }
       reply(res, taskBySession({ store, sessionId: decodeURIComponent(m[1]), agents: ctx.agents }))

package/lib/routes.js

@@ -16,24 +16,63 @@ import { computeNextRun } from './cron.js'
 /** Maximum request payload size to prevent denial of service. */
 export const MAX_BODY_BYTES = 256 * 1024
 
-function isLoopbackAddress(addr) {
-  if (!addr) return true
-  return addr === '127.0.0.1' ||
-    addr === '::1' ||
-    addr === '::ffff:127.0.0.1' ||
-    addr === 'localhost'
+export function isLoopbackAddress(addr) {
+  if (!addr || typeof addr !== 'string') return false
+  const clean = addr.toLowerCase().replace(/^::ffff:/, '').replace(/^\[|\]$/g, '')
+  return (
+    clean === '127.0.0.1' ||
+    clean === '::1' ||
+    clean === 'localhost' ||
+    clean === 'localhost.' ||
+    clean.startsWith('127.')
+  )
+}
+
+export function isLanAddress(addr) {
+  if (!addr || typeof addr !== 'string') return false
+  const clean = addr.toLowerCase().replace(/^::ffff:/, '').replace(/^\[|\]$/g, '')
+  if (isLoopbackAddress(clean)) return true
+  if (clean.startsWith('10.') || clean.startsWith('192.168.')) return true
+  const m = clean.match(/^172\.(\d+)\./)
+  if (m) {
+    const octet = parseInt(m[1], 10)
+    if (octet >= 16 && octet <= 31) return true
+  }
+  return false
+}
+
+export function isTrustedHost(host) {
+  if (!host || typeof host !== 'string') return false
+  let hostname = host.trim()
+  if (hostname.startsWith('[')) {
+    const end = hostname.indexOf(']')
+    if (end > 0) hostname = hostname.slice(1, end)
+  } else {
+    hostname = hostname.split(':')[0]
+  }
+  hostname = hostname.toLowerCase()
+  if (!hostname) return false
+  if (hostname === 'localhost' || hostname === 'localhost.' || hostname.endsWith('.local')) return true
+  if (isLoopbackAddress(hostname) || isLanAddress(hostname)) return true
+  return false
 }
 
 /**
- * Cross-site request validation (#261).
- * Mutating endpoints modify local state and reject cross-site requests:
- * 1. Safe sec-fetch-site ('same-origin', 'same-site', 'none').
- * 2. Origin matches host header (when origin is present).
- * 3. Loopback remoteAddress (127.0.0.1, ::1, ::ffff:127.0.0.1).
+ * Cross-site request and DNS rebinding validation (#261, #369).
+ * Endpoints reject cross-site and DNS-rebinding requests:
+ * 1. Host header is required and must target a trusted host (loopback, LAN, .local).
+ * 2. Origin/Referer (if present) must target a trusted host and match Host header.
+ * 3. Safe sec-fetch-site ('same-origin', 'same-site', 'none').
+ * 4. Loopback or private LAN remoteAddress.
  */
 export function isTrustedRequest(req) {
   if (!req || !req.headers) return false
 
+  const host = req.headers.host
+  if (!host || !isTrustedHost(host)) {
+    return false
+  }
+
   const remote = req.socket?.remoteAddress || req.connection?.remoteAddress
   const site = req.headers['sec-fetch-site']
 
@@ -42,47 +81,49 @@ export function isTrustedRequest(req) {
     return false
   }
 
-  // 2. Browser request with declared site:
+  // 2. Validate origin against trusted hosts and host header
+  const origin = req.headers.origin
+  if (origin !== undefined) {
+    if (origin === 'null' || !origin) return false
+    try {
+      const parsed = new URL(origin)
+      if (!isTrustedHost(parsed.hostname)) return false
+      if (parsed.host && parsed.host !== host) return false
+    } catch {
+      return false
+    }
+  }
+
+  // 3. Validate referer against trusted hosts and host header if present
+  const referer = req.headers.referer
+  if (referer !== undefined && referer) {
+    try {
+      const parsedRef = new URL(referer)
+      if (!isTrustedHost(parsedRef.hostname)) return false
+      if (parsedRef.host && parsedRef.host !== host) return false
+    } catch {
+      return false
+    }
+  }
+
+  // 4. Browser request with declared site:
   // Must be same-origin or none (e.g. top-level navigation / bookmark / isolated subresource)
   if (site === 'same-origin' || site === 'none') {
-    const origin = req.headers.origin
-    if (origin !== undefined) {
-      if (origin === 'null') return false
-      try {
-        const parsed = new URL(origin)
-        const host = req.headers.host || ''
-        if (parsed.host && parsed.host !== host) return false
-      } catch {
-        return false
-      }
-    }
-    // Remote client must be loopback if present
-    if (remote && !isLoopbackAddress(remote)) {
+    if (remote && !isLoopbackAddress(remote) && !isLanAddress(remote)) {
       return false
     }
     return true
   }
 
-  // 3. Request without declared site:
+  // 5. Request without declared site:
   // Allowed strictly for loopback remoteAddress (DSH Desktop Electron forwardWebRequest, local CLI, curl)
   if (remote && isLoopbackAddress(remote)) {
-    const origin = req.headers.origin
-    if (origin !== undefined) {
-      if (origin === 'null') return false
-      try {
-        const parsed = new URL(origin)
-        const host = req.headers.host || ''
-        if (parsed.host && parsed.host !== host) return false
-      } catch {
-        return false
-      }
-    }
     return true
   }
 
-  // Fallback for test harnesses / mocks without socket where host header targets loopback 
-  if (!remote && req.headers.host) {
-    const hostName = String(req.headers.host).split(':')[0]
+  // 6. Fallback for test harnesses / mocks without socket where host header targets loopback
+  if (!remote && host) {
+    const hostName = String(host).split(':')[0]
     if (isLoopbackAddress(hostName)) {
       return true
     }

package/lib/updater.js

@@ -232,7 +232,6 @@ async function installExact(target, packageSpec, options) {
         '--profile',
         target.profileName,
         'add',
-        '--config.minimumReleaseAge=0',
         packageSpec,
         `--registry=${options.registry ?? 'https://registry.npmjs.org/'}`,
       ],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-kanban",
-  "version": "0.2.27",
+  "version": "0.2.28",
   "description": "Visual Kanban board for DeepSeek Harness: Gitea and GitHub-backed tasks, workflow columns, and a dedicated agent session per task.",
   "type": "module",
   "main": "lib/index.js",
@@ -18,6 +18,10 @@
     "README.ru.md",
     "LICENSE"
   ],
+  "scripts": {
+    "test": "node --test test/*.test.mjs",
+    "compat": "node tools/compat.mjs"
+  },
   "keywords": [
     "dsh",
     "dsh-plugin",
@@ -89,9 +93,5 @@
     "@deepseek-ai/dsh-tools": {
       "optional": true
     }
-  },
-  "scripts": {
-    "test": "node --test test/*.test.mjs",
-    "compat": "node tools/compat.mjs"
   }
-}
+}