@goodandready/dsh-messenger-gateway 0.4.9 → 0.4.10

package/lib/file-manager.js

@@ -1,5 +1,6 @@
+import { realpathSync } from 'node:fs'
 import { readdir, stat, readFile } from 'node:fs/promises'
-import { resolve, normalize, relative, join, extname, isAbsolute } from 'node:path'
+import { resolve, normalize, relative, join, extname, isAbsolute, sep, dirname } from 'node:path'
 
 export function formatFileSize(bytes) {
   if (!Number.isFinite(bytes) || bytes <= 0) return '0 B'
@@ -9,6 +10,17 @@ export function formatFileSize(bytes) {
   return `${val} ${units[i]}`
 }
 
+function isSubpath(parent, child) {
+  const normParent = normalize(parent)
+  const normChild = normalize(child)
+  if (process.platform === 'win32') {
+    const p = normParent.toLowerCase()
+    const c = normChild.toLowerCase()
+    return c === p || c.startsWith(p.endsWith(sep) ? p : p + sep)
+  }
+  return normChild === normParent || normChild.startsWith(normParent.endsWith(sep) ? normParent : normParent + sep)
+}
+
 export function resolveSafePath(baseCwd, userPath = '.') {
   const base = resolve(normalize(baseCwd || process.cwd()))
   const cleanUser = String(userPath || '').trim() || '.'
@@ -21,6 +33,46 @@ export function resolveSafePath(baseCwd, userPath = '.') {
     err.code = 'ERR_PATH_TRAVERSAL'
     throw err
   }
+
+  try {
+    const realBase = realpathSync(base)
+    try {
+      const realTarget = realpathSync(target)
+      if (!isSubpath(realBase, realTarget)) {
+        const err = new Error('Access denied: symlink resolves out of workspace')
+        err.code = 'ERR_PATH_TRAVERSAL'
+        throw err
+      }
+    } catch (targetErr) {
+      if (targetErr?.code === 'ERR_PATH_TRAVERSAL') throw targetErr
+      if (targetErr?.code === 'ENOENT') {
+        let curr = dirname(target)
+        while (curr === base || isSubpath(base, curr)) {
+          try {
+            const realCurr = realpathSync(curr)
+            if (!isSubpath(realBase, realCurr)) {
+              const err = new Error('Access denied: symlink ancestor resolves out of workspace')
+              err.code = 'ERR_PATH_TRAVERSAL'
+              throw err
+            }
+            break
+          } catch (ancestorErr) {
+            if (ancestorErr?.code === 'ERR_PATH_TRAVERSAL') throw ancestorErr
+            if (ancestorErr?.code === 'ENOENT') {
+              const parent = dirname(curr)
+              if (parent === curr) break
+              curr = parent
+              continue
+            }
+            break
+          }
+        }
+      }
+    }
+  } catch (baseErr) {
+    if (baseErr?.code === 'ERR_PATH_TRAVERSAL') throw baseErr
+  }
+
   return { base, target, relativePath: rel || '.' }
 }
 

package/lib/http.js

@@ -36,7 +36,7 @@ export function isLoopback(value) {
     || address.startsWith('::ffff:127.')
 }
 
-export function isTrustedSettingsRequest(req) {
+export function isTrustedSettingsRequest(req, expectedSecret) {
   const remote = req?.socket?.remoteAddress
   const host = String(req?.headers?.host || '')
   if (!host) return false
@@ -44,6 +44,21 @@ export function isTrustedSettingsRequest(req) {
   const site = String(req?.headers?.['sec-fetch-site'] || '').toLowerCase()
   if (site === 'cross-site') return false
 
+  const secret = String(expectedSecret || '').trim()
+  if (secret) {
+    const authHeader = req?.headers?.authorization || ''
+    const bearer = authHeader.startsWith('Bearer ') ? authHeader.slice(7).trim() : ''
+    const tokenHeader = req?.headers?.['x-webhook-secret'] || ''
+    const provided = bearer || tokenHeader
+    if (provided && timingSafeCompare(provided, secret)) {
+      return true
+    }
+  }
+
+  if (remote !== undefined && !isLoopback(remote)) {
+    return false
+  }
+
   const origin = String(req?.headers?.origin || '')
   if (origin) {
     try {
@@ -67,7 +82,6 @@ export function isTrustedSettingsRequest(req) {
   }
 
   if (site === 'same-origin') {
-    if (remote !== undefined && !isLoopback(remote)) return false
     return true
   }
 
@@ -78,10 +92,9 @@ export function isAuthorizedMessengerRequest(req, webhooksConfig) {
   const site = String(req?.headers?.['sec-fetch-site'] || '').toLowerCase()
   if (site === 'cross-site') return false
 
-  if (isTrustedSettingsRequest(req)) return true
-  if (isLoopback(req?.socket?.remoteAddress)) return true
-
   const secret = String(webhooksConfig?.secret || '').trim()
+  if (isTrustedSettingsRequest(req, secret)) return true
+  if (isLoopback(req?.socket?.remoteAddress)) return true
   if (secret) {
     const authHeader = req?.headers?.authorization || ''
     const bearer = authHeader.startsWith('Bearer ') ? authHeader.slice(7).trim() : ''

package/lib/index.js

@@ -380,7 +380,7 @@ export function apply(ctx, config) {
     kind: 'exact', path: '/dsh-messenger-gateway/smoke',
     handler: async (req, res) => {
       if (req.method !== 'POST') return writeJson(res, 405, { ok: false, error: 'POST only' })
-      if (!isTrustedSettingsRequest(req)) return writeJson(res, 403, { ok: false, error: 'forbidden' })
+      if (!isTrustedSettingsRequest(req, source().webhooks?.secret)) return writeJson(res, 403, { ok: false, error: 'forbidden' })
       const gw = getGw()
       if (!gw) return writeJson(res, 503, { ok: false, error: 'gateway not running' })
       const parsed = await readJsonSafe(req, res, 65536)
@@ -457,7 +457,7 @@ export function apply(ctx, config) {
     handler: async (req, res) => {
       if (req.method === 'GET') return writeJson(res, 200, { ok: true, config: publicConfig(source()) })
       if (req.method !== 'PUT') return writeJson(res, 405, { ok: false, error: 'GET or PUT' })
-      if (!isTrustedSettingsRequest(req)) return writeJson(res, 403, { ok: false, error: 'forbidden' })
+      if (!isTrustedSettingsRequest(req, source().webhooks?.secret)) return writeJson(res, 403, { ok: false, error: 'forbidden' })
       if (!settingsApi?.isReady?.()) return writeJson(res, 503, { ok: false, error: 'settings not ready' })
       const parsedConfig = await readJsonSafe(req, res, 1_048_576)
       if (!parsedConfig.ok) return
@@ -499,7 +499,7 @@ export function apply(ctx, config) {
     kind: 'exact', path: '/dsh-messenger-gateway/pairing',
     handler: async (req, res) => {
       if (req.method !== 'GET') return writeJson(res, 405, { ok: false, error: 'GET only' })
-      if (!isTrustedSettingsRequest(req)) return writeJson(res, 403, { ok: false, error: 'forbidden' })
+      if (!isTrustedSettingsRequest(req, source().webhooks?.secret)) return writeJson(res, 403, { ok: false, error: 'forbidden' })
       const gw = getGw()
       if (!gw) return writeJson(res, 503, { ok: false, error: 'gateway not running' })
       writeJson(res, 200, {
@@ -514,7 +514,7 @@ export function apply(ctx, config) {
     kind: 'exact', path: '/dsh-messenger-gateway/pairing/approve',
     handler: async (req, res) => {
       if (req.method !== 'POST') return writeJson(res, 405, { ok: false, error: 'POST only' })
-      if (!isTrustedSettingsRequest(req)) return writeJson(res, 403, { ok: false, error: 'forbidden' })
+      if (!isTrustedSettingsRequest(req, source().webhooks?.secret)) return writeJson(res, 403, { ok: false, error: 'forbidden' })
       const gw = getGw()
       if (!gw) return writeJson(res, 503, { ok: false, error: 'gateway not running' })
       const parsed = await readJsonSafe(req, res, 65536)
@@ -528,7 +528,7 @@ export function apply(ctx, config) {
     kind: 'exact', path: '/dsh-messenger-gateway/pairing/reject',
     handler: async (req, res) => {
       if (req.method !== 'POST') return writeJson(res, 405, { ok: false, error: 'POST only' })
-      if (!isTrustedSettingsRequest(req)) return writeJson(res, 403, { ok: false, error: 'forbidden' })
+      if (!isTrustedSettingsRequest(req, source().webhooks?.secret)) return writeJson(res, 403, { ok: false, error: 'forbidden' })
       const gw = getGw()
       if (!gw) return writeJson(res, 503, { ok: false, error: 'gateway not running' })
       const parsed = await readJsonSafe(req, res, 65536)

package/lib/locales/index.js

@@ -9,11 +9,20 @@ export function getLocaleDictionary(locale = 'en') {
   return en
 }
 
-export function t(key, params = {}, locale = 'en') {
+export function escapeHtml(text) {
+  return String(text ?? '')
+    .replace(/&/g, '&')
+    .replace(/</g, '&lt;')
+    .replace(/>/g, '&gt;')
+}
+
+export function t(key, params = {}, locale = 'en', options = {}) {
   const dict = getLocaleDictionary(locale)
   let template = dict[key] || en[key] || key
+  const escape = options.escape !== false
   for (const [k, v] of Object.entries(params)) {
-    template = template.replaceAll(`{${k}}`, String(v))
+    const val = escape ? escapeHtml(v) : String(v)
+    template = template.replaceAll(`{${k}}`, val)
   }
   return template
 }

package/lib/telegram-format.js

@@ -7,12 +7,33 @@ export function escapeHtml(text) {
 
 const PH = '\uE000'
 
+const SAFE_SCHEMES = new Set(['https:', 'http:', 'tg:'])
+
+export function isSafeUrl(rawUrl) {
+  if (!rawUrl || typeof rawUrl !== 'string') return false
+  const clean = rawUrl.replace(/&/g, '&').trim()
+  try {
+    const parsed = new URL(clean)
+    return SAFE_SCHEMES.has(parsed.protocol.toLowerCase())
+  } catch {
+    if (/^tg:\/\//i.test(clean)) return true
+    return false
+  }
+}
+
+export function formatSafeLink(label, url) {
+  if (!isSafeUrl(url)) {
+    return `${label} (${url})`
+  }
+  return `<a href="${url.replace(/"/g, '%22')}">${label}</a>`
+}
+
 // Render inline markdown (bold/italic/code/links) inside already-HTML-escaped text.
 function renderInline(t) {
   let s = escapeHtml(t)
   s = s.replace(/\*\*([^*\n]+)\*\*/g, '<b>$1</b>')
   s = s.replace(/`([^`\n]+)`/g, '<code>$1</code>')
-  s = s.replace(/\[([^\]]+)\]\(([^)\s]+)\)/g, (_, label, url) => `<a href="${url.replace(/"/g, '%22')}">${label}</a>`)
+  s = s.replace(/\[([^\]]+)\]\(([^)\s]+)\)/g, (_, label, url) => formatSafeLink(label, url))
   s = s.replace(/(^|[^*])\*([^*\n]+)\*(?!\*)/g, '$1<i>$2</i>')
   return s
 }
@@ -123,7 +144,7 @@ export function markdownToTelegramHtml(markdown) {
   text = convertDetails(text, stash)
   text = convertTaskLists(text, stash)
   text = escapeHtml(text)
-  text = text.replace(/\[([^\]]+)\]\(([^)\s]+)\)/g, (_, label, url) => `<a href="${url.replace(/"/g, '%22')}">${label}</a>`)
+  text = text.replace(/\[([^\]]+)\]\(([^)\s]+)\)/g, (_, label, url) => formatSafeLink(label, url))
   text = text.replace(/\*\*([^*\n]+)\*\*/g, '<b>$1</b>')
   text = text.replace(/__([^_\n]+)__/g, '<b>$1</b>')
   text = text.replace(/~~([^~\n]+)~~/g, '<s>$1</s>')

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-messenger-gateway",
-  "version": "0.4.9",
+  "version": "0.4.10",
   "description": "Telegram messenger bridge for DeepSeek Harness: sessions, steer, homes, inline asks, notify bridge, and optional TTS voice notes.",
   "license": "MIT",
   "type": "module",